shibboleth RPM and "/etc/init.d/shibd"

[Cantor, Scott E.]

On 8/12/11 7:45 AM, "Sami Silén" <Sami.Silen at csc.fi> wrote:
>I was wondering is there a reason why shibd init script is specified as a
>replaceable file in a rpm or is there better workaround for my problem?
>As far as I have understood, in the ³/etc/httpd/conf.d/shib.conf² we
>shouldn¹t configure anything. For own configurations we should use own
>file on that directory including our specific shibboleth configurations,
>this way we prevent problems with upgrades (file can be replaced with
>file from RPM).

Until there's a change to the packaging, yes (see email sent to dev list
this week asking for feedback, so far none).

>But is there some way to prevent this same problem with
>³/etc/init.d/shibd² script. In our situation we¹re not running shibd
>process under root ownership, we¹re using different user. After each
>upgrade ownership changes back to root and then we have to go thru all
>service providers and fix them. If this situation wouldn¹t exist,
>upgrading would happen nicely and quite transparent. Am I doing something
>wrong?

Yes, you're using a package explicitly designed to use root as non-root.
That is not supported. There is an issue filed to create a non-root
package. You should do your own packaging if you want non-root behavior
now.

Based on the limitations I see on changing files or permissions of
existing files, I suspect doing a non-root version will end up being a
totally separate package rather than an upgrade path from the current one.
And I'm not committing for certain to actually do one.

-- Scott