PR#11: clevis: simplify sysusers.d fragment by using default 'nologin' shell - rpms/clevis

rpms / clevis

#11 clevis: simplify sysusers.d fragment by using default 'nologin' shell

Merged 2 years ago by scorreia. Opened 2 years ago by lucab.

rpms/ lucab/clevis ups/sysusers-tweak into rawhide

clevis: simplify sysusers.d fragment by using default 'nologin' shell

Luca BRUNO • 2 years ago

9415713

clevis.spec

file modified

+4 -1

		`@@ -1,6 +1,6 @@`
		`Name: clevis`
		`Version: 18`
		`- Release: 9%{?dist}`
		`+ Release: 10%{?dist}`
		`Summary: Automated decryption framework`

		`License: GPLv3+`
		`@@ -192,6 +192,9 @@`
		`systemctl preset %{name}-luks-askpass.path >/dev/null 2>&1 \|\| :`

		`%changelog`
		`+ * Fri Aug 05 2022 Luca BRUNO <lucab@lucabruno.net> - 18-10`
		`+ - Simplify sysusers.d fragment by using default 'nologin' shell`
		`+`
		`* Wed Jul 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 18-9`
		`- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild`

clevis.sysusers

file modified

+1 -1

		`@@ -1,1 +1,1 @@`
		`- u clevis - "Clevis Decryption Framework unprivileged user" /var/cache/clevis /usr/sbin/nologin`
		`+ u clevis - "Clevis Decryption Framework unprivileged user" /var/cache/clevis -`

lucab commented 2 years ago

This tweaks the existing sysuser.d fragment in order to simplify it.
The 'nologin' shell is the documented systemd default, so there is
no need to explicitly specify it.
This change allows better handling of default vs custom shell in the
macro logic which bridges between systemd-sysusers and useradd.

lucab commented 2 years ago

/cc @scorreia @pbrobinson

scorreia commented 2 years ago

Thanks, it looks good to me.

I will merge this, but while you are at it, could you also move the part where we add the user to the tss group to sysusers? Probably adding a line like "m clevis tss" would do.

Pull-Request has been merged by scorreia

2 years ago

lucab commented 2 years ago

I have that one on my radar too, yes.
The m clevis tss part is correct, but I think the bridging logic for that is currently buggy in the RPM macro. I'll try to have a chat about that with the systemd folks, let's keep the specfile logic as is for now.
Can you please build and push this -10 to F37 and F36?