[JIRA] Resolved: (SSPCPP-494) Shibboleth-SP RPM performs bulk right changes in the log directory

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/SSPCPP-494?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor resolved SSPCPP-494.
---------------------------------

    Resolution: Won't Fix

The official packages do not support what you're describing. Any directories owned by the SP are not allowed to be used to store other files unless you take responsibility for any conflicts that arise or do your own packaging.

I also don't think I could fix this. I have to change the directory ownership so that new files can be created, but that could and probably would lock out the IdP from doing its own file creation.

Also, anywhere I can do so easily, I prefer not to constrain the config options people use. If somebody changed the default log filenames the SP creates, my current package update works for them, but your change would not. I realize that's rare, but it would be wrong to favor unsupported use over fully supported config behavior.

I appreciate that using "shibboleth" instead of "shibboleth-sp" can create some confusion, but as we saw, trying to fix that now is more or less hopeless.

If you have a suggestion as to where I should put a warning about this, I can do so. Maybe on the RPM install page, I guess.


> Shibboleth-SP RPM performs bulk right changes in the log directory
> ------------------------------------------------------------------
>
>                 Key: SSPCPP-494
>                 URL: https://issues.shibboleth.net/jira/browse/SSPCPP-494
>             Project: Shibboleth SP - C++
>          Issue Type: Improvement
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: Logging
>    Affects Versions: 2.5.0
>            Reporter: Olivier Salaun
>            Assignee: Scott Cantor
>            Priority: Minor
>   Original Estimate: 1 hour
>  Remaining Estimate: 1 hour
>
> We have a server running both the Shibboleth SP and IdP. IdP has been configured to log in the same directory as the SP (/var/log/shibboleth).
> A recent update of the Shibboleth SP changed the ownership of all /var/log/shibboleth/* files including the IdP log files. Therefore the IdP stopped logging until we found out the problem.
> It seems that the RPM did this on purpose, cf the SPEC file :
> # Fix ownership of log files (even on new installs, if they're left from an older one).
> %{__chown} %{runuser}:%{runuser} %{_localstatedir}/log/shibboleth/* 2>/dev/null || :
> I'd suggest removing this from the SPEC file or make it more targeted to preserve other existing files that might be in the same directory.
> Thanks.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira