Unexpected RPM behavior

[Brian Mathis]

I'm using CentOS 5 and the security:shibboleth.repo.  I recently
applied an update from shibboleth-2.4.1-2.1.i386 to
shibboleth-2.4.3-2.2.i386, and encountered some unexpected behavior
with the RPM.  Here is a summary:

1) The rpm overwrote the /etc/rc.d/init.d/shibd file, and saved the
old one as /etc/rc.d/init.d/shibd.rpmsave.  This is abnormal behavior
for an rpm -- the new file should be created as
/etc/rc.d/init.d/shibd.rpmnew so the admin can review the changes.
This is important because of #2.

2) Services (shibd, httpd) were restarted automatically.  Generally
the admin would like control over when the services restart,
especially when new config files have been delivered and saved as
"rpmnew" files.  This caused a problem because I have modified the
start script to run as user 'shibsp' instead of the default (and
terrible) 'root'.  Upon upgrading, the service was automatically
started as 'root' and file ownership was changed on log files, causing
extra work after changing the shibd start script back to the correct
user.


P.S. Changing shibd to run as a regular user instead of root is pretty
simple, and this really should be the default.  Here are the steps I
used.  Only running as an SP.

Create user
   useradd -r --create-home shibsp
Update init.d script
   vim /etc/init.d/shibd
   Update:
      SHIBD_USER=shibsp
Update file/directory ownership
   chown -R shibsp /var/log/shibboleth
   chown -R shibsp /var/run/shibboleth
   chown shibsp /etc/shibboleth/*.pem


-☙ Brian Mathis ❧-