sysusers.d support applies %attr() ownership before creating sysusers

[martinpitt]

We are currently trying to move our project to systemd-sysusers, away from manual useradd calls in the package's %pre script. The rpm manual claims

Rpm >= 4.19 has native support for declarative user and group creation through integration with systemd’s sysusers.d format. Packagers will only need to package a sysusers.d file for their custom users and groups in /usr/lib/sysusers.d and rpm will take care of the rest.

I tried that on current Fedora 40 (rpm-4.19.1.1-1.fc40.x86_64), and an initial version with a clean approach just adds %{_sysusersdir}/cockpit-ws.conf file to the rpm. The diff doesn't show the existing

attr(4750, root, cockpit-wsinstance) %{_libexecdir}/cockpit-session

in the spec which makes use of the dynamic group.

The rpm build does create the "magic" provides:

# rpm -q --provides cockpit-ws
cockpit-ws = 316.dev27+g1dc9d3b8f-1.fc40
cockpit-ws(x86-64) = 316.dev27+g1dc9d3b8f-1.fc40
config(cockpit-ws) = 316.dev27+g1dc9d3b8f-1.fc40
group(cockpit-ws)
group(cockpit-wsinstance)
user(cockpit-ws) = dSBjb2NrcGl0LXdzIC0gIlVzZXIgZm9yIGNvY2twaXQgd2ViIHNlcnZpY2UiIC0A
user(cockpit-wsinstance) = dSBjb2NrcGl0LXdzaW5zdGFuY2UgLSAiVXNlciBmb3IgY29ja3BpdC13cyBpbnN0YW5jZXMiIC0A

# echo dSBjb2NrcGl0LXdzIC0gIlVzZXIgZm9yIGNvY2twaXQgd2ViIHNlcnZpY2UiIC0A | base64 -d
u cockpit-ws - "User for cockpit web service" -

On install it does create the sysusers, but it tries to apply the %attr before creating the users:

# rpm -i --verbose /var/tmp/build/cockpit-ws-316.dev27+g1dc9d3b8f-1.fc40.x86_64.rpm 
Verifying packages...
Preparing packages...
cockpit-ws-316.dev27+g1dc9d3b8f-1.fc40.x86_64
warning: group cockpit-wsinstance does not exist - using root
Creating group 'cockpit-ws' with GID 979.
Creating user 'cockpit-ws' (User for cockpit web service) with UID 979 and GID 979.
Creating group 'cockpit-wsinstance' with GID 978.
Creating user 'cockpit-wsinstance' (User for cockpit-ws instances) with UID 978 and GID 978.

and after installation, /usr/libexec/cockpit-session has the wrong ownership (group root).

So for the docs to actually work, it needs to create the sysusers before unpacking (i.e. what a %pre script would do) from its "magic" provides or other internal .rpm metadata, or defer the %attr() application after the initial unpacking of the files and sysusers creation.

I suppose that is the reason why the Fedora packaging guidelines have a completely different, and very hackish approach -- that suggests to duplicate the sysusers file downstream in the packaging dist-git, and using %sysusers_create_compat to basically create some useradd shell script out of the sysusers.d file. But this is awkward, error prone, a bit hard to automate for releases. It also feels backwards -- the whole point is to move and standardize all of this upstream.

I didn't find any existing upstream or Fedora downstream (bugzilla) bug report, so filing this one.

Thanks!

CC: @travier

[ffesti]

A far as I know this feature is not enabled in Fedora 40. See https://fedoraproject.org/wiki/Changes/RPM-4.19#Scope

rpm-4.18.92-disable-sysusers.patch

iff -up rpm-4.18.92/macros.in.orig rpm-4.18.92/macros.in                       
--- rpm-4.18.92/macros.in.orig  2023-08-02 17:56:49.858065935 +0200             
+++ rpm-4.18.92/macros.in       2023-08-02 17:57:01.967988065 +0200             
@@ -138,7 +138,7 @@                                                             
                                                                                
 # sysusers helper binary (or a replacement script), uncomment to disable       
 #%__systemd_sysusers   @__SYSTEMD_SYSUSERS@                                    
-%__systemd_sysusers    %{_rpmconfigdir}/sysusers.sh                            
+#%__systemd_sysusers   %{_rpmconfigdir}/sysusers.sh                            
                                                                                
 #                                                                              
 #      Path to script that creates debug symbols in a /usr/lib/debug

So there is some work to do on the Fedora side to make sure the distribution is ready for this.

[martinpitt]

Thanks @ffesti ! So I suppose this should be closed upstream, and I'll create a bugzilla instead?

[travier]

Ah, good point. This needs discussion on the Fedora side.

[ffesti]

Yeah, this probably needs a discussion and Global Change in Fedora and an additional change in the Packaging Guidelines. Those are not topics for upstream. So I am closing this here. But fee free to ping me if you need help on the Fedora side. We will also happily improve the documentation upstream with lessons learned.

Also note that there are more improvements coming with the rpm 4.20 release that is expected in Fedora 41 in a few weeks.

[ffesti]

I started a discussion on the Fedora devel list:

https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/IKWECWMBWN2IDKLHK3Q2TZKVSVFTXUNA/