diff options
author | Fabiano Fidêncio <fidencio@redhat.com> | 2016-11-17 00:24:25 +0100 |
---|---|---|
committer | Lukas Slebodnik <lslebodn@redhat.com> | 2017-01-23 18:46:37 +0100 |
commit | 40e9ad2bf250cc3bfcdec7fb96031e2771160f69 (patch) | |
tree | 269f3fe9476d752fd082f47ec6bc6a30f394274c /contrib | |
parent | 61cd5c8307be4c4ac53028c4499b8bdd78e322b6 (diff) | |
download | sssd-40e9ad2bf250cc3bfcdec7fb96031e2771160f69.tar.gz sssd-40e9ad2bf250cc3bfcdec7fb96031e2771160f69.tar.xz sssd-40e9ad2bf250cc3bfcdec7fb96031e2771160f69.zip |
NSS: Make NSS responder socket-activatable
As part of the effort of making all responders socket-activatable, let's
make the NSS responder ready for this by providing its systemd's units.
In case the administrators want to use NSS responder taking advantage
of socket-activation they will need to enable sssd-nss.socket and after
a restart of the sssd service, the NSS socket will be ready waiting for
any activity in order to start the NSS responder. Also, the NSS
responder must be removed from the services line on sssd.conf.
The NSS responder service is binded to the SSSD service, which means
that the responder will be restarted in case SSSD is restarted and
shutdown in case SSSD is shutdown/crashes.
Is quite important to mention that NSS responder will always run as
root. The reason behind this is that systemd calls getpwnam() and
getgprnam() when "User="/"Group=" is set to something different than
"root". As it's done _before_ starting NSS responder, the clients would
end up hanging for a few minutes (due to "default_client_timeout"),
which is something that we really want to avoid.
Related:
https://fedorahosted.org/sssd/ticket/2243
Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
Diffstat (limited to 'contrib')
-rw-r--r-- | contrib/sssd.spec.in | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/contrib/sssd.spec.in b/contrib/sssd.spec.in index 93f023a74..519246b43 100644 --- a/contrib/sssd.spec.in +++ b/contrib/sssd.spec.in @@ -801,6 +801,8 @@ done %{_unitdir}/sssd.service %{_unitdir}/sssd-autofs.socket %{_unitdir}/sssd-autofs.service +%{_unitdir}/sssd-nss.socket +%{_unitdir}/sssd-nss.service %{_unitdir}/sssd-secrets.socket %{_unitdir}/sssd-secrets.service %else @@ -1136,17 +1138,21 @@ getent passwd sssd >/dev/null || useradd -r -g sssd -d / -s /sbin/nologin -c "Us %post common %systemd_post sssd.service %systemd_post sssd-autofs.socket +%systemd_post sssd-nss.socket %systemd_post sssd-secrets.socket %preun common %systemd_preun sssd.service %systemd_preun sssd-autofs.socket +%systemd_preun sssd-nss.socket %systemd_preun sssd-secrets.socket %postun common %systemd_postun_with_restart sssd.service %systemd_postun_with_restart sssd-autofs.socket %systemd_postun_with_restart sssd-autofs.service +%systemd_postun_with_restart sssd-nss.socket +%systemd_postun_with_restart sssd-nss.service %systemd_postun_with_restart sssd-secrets.socket %systemd_postun_with_restart sssd-secrets.service |