diff options
author | Rob Crittenden <rcritten@redhat.com> | 2012-02-28 23:05:06 -0500 |
---|---|---|
committer | Martin Kosek <mkosek@redhat.com> | 2012-02-29 22:36:13 +0100 |
commit | a5a55ceff3822ede55ad817ede0da5712fb75651 (patch) | |
tree | ccab9b5a4f9389bcea4cb04c3f91de9d98ca20eb /ipaserver/install/cainstance.py | |
parent | 610420bd2ab976ea9e35e6d010e3f1c9f572c646 (diff) | |
download | freeipa.git-a5a55ceff3822ede55ad817ede0da5712fb75651.tar.gz freeipa.git-a5a55ceff3822ede55ad817ede0da5712fb75651.tar.xz freeipa.git-a5a55ceff3822ede55ad817ede0da5712fb75651.zip |
Don't delete system users that are added during installation.
We don't want to run the risk of adding a user, uninstalling it,
the system adding a new user (for another package install for example)
and then re-installing IPA. This wreaks havoc with file and directory
ownership.
https://fedorahosted.org/freeipa/ticket/2423
Diffstat (limited to 'ipaserver/install/cainstance.py')
-rw-r--r-- | ipaserver/install/cainstance.py | 24 |
1 files changed, 6 insertions, 18 deletions
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py index d2c8d057..345a8c2d 100644 --- a/ipaserver/install/cainstance.py +++ b/ipaserver/install/cainstance.py @@ -274,12 +274,10 @@ class CADSInstance(service.Service): GROUP=dsinstance.DS_GROUP) def __create_ds_user(self): - user_exists = True try: pwd.getpwnam(PKI_DS_USER) root_logger.debug("ds user %s exists" % PKI_DS_USER) except KeyError: - user_exists = False root_logger.debug("adding ds user %s" % PKI_DS_USER) args = ["/usr/sbin/useradd", "-g", dsinstance.DS_GROUP, "-c", "PKI DS System User", @@ -292,8 +290,6 @@ class CADSInstance(service.Service): except ipautil.CalledProcessError, e: root_logger.critical("failed to add user %s" % e) - self.backup_state("user_exists", user_exists) - def __create_instance(self): self.backup_state("running", dsinstance.is_ds_running()) self.backup_state("serverid", self.serverid) @@ -406,11 +402,9 @@ class CADSInstance(service.Service): user_exists = self.restore_state("user_exists") - if user_exists == False: - try: - ipautil.run(["/usr/sbin/userdel", PKI_DS_USER]) - except ipautil.CalledProcessError, e: - root_logger.critical("failed to delete user %s" % e) + # At one time we removed this user on uninstall. That can potentially + # orphan files, or worse, if another useradd runs in the intermim, + # cause files to have a new owner. class CAInstance(service.Service): """ @@ -566,12 +560,10 @@ class CAInstance(service.Service): # so actual enablement is delayed. def __create_ca_user(self): - user_exists = True try: pwd.getpwnam(PKI_USER) root_logger.debug("ca user %s exists" % PKI_USER) except KeyError: - user_exists = False root_logger.debug("adding ca user %s" % PKI_USER) args = ["/usr/sbin/useradd", "-c", "CA System User", "-d", "/var/lib", @@ -583,8 +575,6 @@ class CAInstance(service.Service): except ipautil.CalledProcessError, e: root_logger.critical("failed to add user %s" % e) - self.backup_state("user_exists", user_exists) - def __configure_instance(self): preop_pin = get_preop_pin(self.server_root, PKI_INSTANCE_NAME) @@ -1064,12 +1054,10 @@ class CAInstance(service.Service): except ipautil.CalledProcessError, e: root_logger.critical("failed to uninstall CA instance %s" % e) + # At one time we removed this user on uninstall. That can potentially + # orphan files, or worse, if another useradd runs in the intermim, + # cause files to have a new owner. user_exists = self.restore_state("user_exists") - if user_exists == False: - try: - ipautil.run(["/usr/sbin/userdel", PKI_USER]) - except ipautil.CalledProcessError, e: - root_logger.critical("failed to delete user %s" % e) def publish_ca_cert(self, location): args = ["-L", "-n", self.canickname, "-a"] |