[Freeipa-devel] [PATCH 0037] Added /etc/krb5.conf.d/ to krb5.conf

[Martin Basti]

On 31.05.2016 19:19, Robbie Harwood wrote:
> Alexander Bokovoy <abokovoy at redhat.com> writes:
>
>> On Sat, 28 May 2016, Robbie Harwood wrote:
>>> Alexander Bokovoy <abokovoy at redhat.com> writes:
>>>> On Fri, 27 May 2016, Robbie Harwood wrote:
>>>>> Stanislav Laznicka <slaznick at redhat.com> writes:
>>>>>> From: Stanislav Laznicka <slaznick at redhat.com>
>>>>>>
>>>>>> The include of /etc/krb5.conf.d/ is required for crypto-policies
>>>>>> to work properly
>>>>>>
>>>>>> https://fedorahosted.org/freeipa/ticket/5912
>>>>> Thank you for working on this.  Is the intent on the part of
>>>>> FreeIPA to keep a separate, freeipa-speicifc directory?  And if so,
>>>>> can I suggest that we not do that?
>>>> SSSD cannot write to /etc and I don't think we have to change it.
>>> Can you elaborate on this?  Why can't sssd write the stuff it puts in
>>> /var/lib into /etc, or symlink it?
>> Writing to /etc is considered a privilege of a system administrator. A
>> runtime override is typically done outside it, in /run like systemd
>> allows for its configuration for volatile setups and in /var/lib
>> for non-volatile ones. The latter has long been a state of affairs in
>> Linux.
>>
>> Currently SSSD runs under root but it is already made possible to run as
>> non-root user and we intend to switch to that mode in future releases.
> I guess I don't see a meaningful difference here.  We're still writing
> to /etc when we modify krb5.conf.
>
> My reading of the FHS is that this is not an intended use of /var/lib:
> /var/lib is for state information [0], and the only time the FHS
> mentions config files is to point out that they go in the /etc tree.
>
> Anyway, I've said my piece and won't derail this further.  If you want
> to merge, this is a cosmetic issue and I can live with it.
>
> [0]: http://www.pathname.com/fhs/pub/fhs-2.3.html#VARLIBVARIABLESTATEINFORMATION
>
>
ACK, this patch works as expected. If nobody is against it, I will push 
it (tomorrow).

Martin^2
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-devel/attachments/20160602/00b648b9/attachment.htm>