diff options
| author | Fabiano Fidêncio <fidencio@redhat.com> | 2016-11-17 00:24:25 +0100 |
|---|---|---|
| committer | Lukas Slebodnik <lslebodn@redhat.com> | 2017-01-23 18:46:37 +0100 |
| commit | 40e9ad2bf250cc3bfcdec7fb96031e2771160f69 (patch) | |
| tree | 269f3fe9476d752fd082f47ec6bc6a30f394274c /src/sysv | |
| parent | 61cd5c8307be4c4ac53028c4499b8bdd78e322b6 (diff) | |
| download | sssd-40e9ad2bf250cc3bfcdec7fb96031e2771160f69.tar.gz sssd-40e9ad2bf250cc3bfcdec7fb96031e2771160f69.tar.xz sssd-40e9ad2bf250cc3bfcdec7fb96031e2771160f69.zip | |
NSS: Make NSS responder socket-activatable
As part of the effort of making all responders socket-activatable, let's
make the NSS responder ready for this by providing its systemd's units.
In case the administrators want to use NSS responder taking advantage
of socket-activation they will need to enable sssd-nss.socket and after
a restart of the sssd service, the NSS socket will be ready waiting for
any activity in order to start the NSS responder. Also, the NSS
responder must be removed from the services line on sssd.conf.
The NSS responder service is binded to the SSSD service, which means
that the responder will be restarted in case SSSD is restarted and
shutdown in case SSSD is shutdown/crashes.
Is quite important to mention that NSS responder will always run as
root. The reason behind this is that systemd calls getpwnam() and
getgprnam() when "User="/"Group=" is set to something different than
"root". As it's done _before_ starting NSS responder, the clients would
end up hanging for a few minutes (due to "default_client_timeout"),
which is something that we really want to avoid.
Related:
https://fedorahosted.org/sssd/ticket/2243
Signed-off-by: Fabiano Fidêncio <fidencio@redhat.com>
Reviewed-by: Pavel Březina <pbrezina@redhat.com>
Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Lukáš Slebodník <lslebodn@redhat.com>
Diffstat (limited to 'src/sysv')
| -rw-r--r-- | src/sysv/systemd/sssd-nss.service.in | 13 | ||||
| -rw-r--r-- | src/sysv/systemd/sssd-nss.socket.in | 12 |
2 files changed, 25 insertions, 0 deletions
diff --git a/src/sysv/systemd/sssd-nss.service.in b/src/sysv/systemd/sssd-nss.service.in new file mode 100644 index 000000000..2e6fc79e3 --- /dev/null +++ b/src/sysv/systemd/sssd-nss.service.in @@ -0,0 +1,13 @@ +[Unit] +Description=SSSD NSS Service responder +Documentation=man:sssd.conf(5) +After=sssd.service +BindsTo=sssd.service + +[Install] +Also=sssd-nss.socket + +[Service] +ExecStartPre=-/bin/chown root:root @logpath@/sssd_nss.log +ExecStart=@libexecdir@/sssd/sssd_nss --debug-to-files --socket-activated +Restart=on-failure diff --git a/src/sysv/systemd/sssd-nss.socket.in b/src/sysv/systemd/sssd-nss.socket.in new file mode 100644 index 000000000..530fa0c48 --- /dev/null +++ b/src/sysv/systemd/sssd-nss.socket.in @@ -0,0 +1,12 @@ +[Unit] +Description=SSSD NSS Service responder socket +Documentation=man:sssd.conf(5) +BindsTo=sssd.service + +[Socket] +ListenStream=@pipepath@/nss +SocketUser=@SSSD_USER@ +SocketGroup=@SSSD_USER@ + +[Install] +WantedBy=sssd.service |