Unexpected RPM behavior

[Cantor, Scott]

On 9/27/11 6:48 PM, "Brian Mathis"
<brian.mathis+shibboleth at betteradmin.com> wrote:
>
>1) The rpm overwrote the /etc/rc.d/init.d/shibd file, and saved the
>old one as /etc/rc.d/init.d/shibd.rpmsave.  This is abnormal behavior
>for an rpm -- the new file should be created as
>/etc/rc.d/init.d/shibd.rpmnew so the admin can review the changes.
>This is important because of #2.

Except that what you were doing below isn't supported by those packages. I
have no plans to convert the init script to noreplace, and I don't think
I'm obligated to. If I did, I couldn't rely on the content if it has to
change. I have bent over backwards to make that possible with the Apache
conf file for the next upgrade, but I don't believe that I should have to
do the same for the init script.

I have however made changes to the package to make it possible for the
expected sysadmin changes to get handled via etc/sysconfig. I expect to
expand the set of options declared there, but I haven't completed that
analysis.

>2) Services (shibd, httpd) were restarted automatically.  Generally
>the admin would like control over when the services restart,
>especially when new config files have been delivered and saved as
>"rpmnew" files.

The platform packaging rules require that I restart the services,
particularly on SUSE. What they don't require is that the init script be
editable by the sysadmin, and in fact currently that is not intended.

>  This caused a problem because I have modified the
>start script to run as user 'shibsp' instead of the default (and
>terrible) 'root'.

Then you are using the packages in an unsupported way, and this is the
expected result. I have already been asked to change that, and I have, but
the current package set is not supported for non-root use.

>P.S. Changing shibd to run as a regular user instead of root is pretty
>simple, and this really should be the default.  Here are the steps I
>used.  Only running as an SP.

It is *not* that easy when you're dealing with multiple distributions,
upgrades from many different versions, and a lot of pedantic people. It
took a week or two of work and testing, and that was after a substantial
contribution, which is why it wasn't done originally.

Be that as it may, it's done and you can find all of that in Jira and svn.
It will not be included with any 2.4 patches, but it is already checked in
for future upgrades.

-- Scott