From b413a327f33c5d97a1f830fe7a9a8aef39c847c1 Mon Sep 17 00:00:00 2001 From: Fraser Tweedale Date: Wed, 9 Mar 2022 14:45:37 +1000 Subject: [PATCH] allow overriding systemd-tmpfiles program In some contexts, filesystem mounts may be owned by unmapped users (e.g. `emptyDir` mounts in Kubernetes / OpenShift when using user namespaces). This causes `systemd-tmpfiles(8)` to fail, as a consequence of systemd's path processing routines which reject this scenario. Therefore, in Fedora container context, if the `IPA_TMPFILES_PROG` environment value is set, use the program specified by its value instead of `/bin/systemd-tmpfiles`. Signed-off-by: Fraser Tweedale Fixes: https://pagure.io/freeipa/issue/9126 Reviewed-By: Rob Crittenden --- ipaplatform/fedora_container/paths.py | 10 ++++++++++ ipaplatform/rhel_container/paths.py | 10 ++++++++++ 2 files changed, 20 insertions(+) diff --git a/ipaplatform/fedora_container/paths.py b/ipaplatform/fedora_container/paths.py index bdfd085d6..d3beeab1f 100644 --- a/ipaplatform/fedora_container/paths.py +++ b/ipaplatform/fedora_container/paths.py @@ -29,5 +29,15 @@ class FedoraContainerPathNamespace(FedoraPathNamespace): HTTPD_IPA_WSGI_MODULES_CONF = None HTTPD_PASSWD_FILE_FMT = data(FedoraPathNamespace.HTTPD_PASSWD_FILE_FMT) + # In some contexts, filesystem mounts may be owned by unmapped users + # (e.g. "emptyDir" mounts in Kubernetes / OpenShift when using user + # namespaces). This causes systemd-tmpfiles(8) to fail, as a + # consequence of systemd's path processing routines which reject + # this scenario. Therefore we provide a way to substitute + # systemd-tmpfiles with a "clone" program. + # + SYSTEMD_TMPFILES = os.environ.get( + 'IPA_TMPFILES_PROG', FedoraPathNamespace.SYSTEMD_TMPFILES) + paths = FedoraContainerPathNamespace() diff --git a/ipaplatform/rhel_container/paths.py b/ipaplatform/rhel_container/paths.py index d16357029..d6a5fcf63 100644 --- a/ipaplatform/rhel_container/paths.py +++ b/ipaplatform/rhel_container/paths.py @@ -29,5 +29,15 @@ class RHELContainerPathNamespace(RHELPathNamespace): HTTPD_IPA_WSGI_MODULES_CONF = None HTTPD_PASSWD_FILE_FMT = data(RHELPathNamespace.HTTPD_PASSWD_FILE_FMT) + # In some contexts, filesystem mounts may be owned by unmapped users + # (e.g. "emptyDir" mounts in Kubernetes / OpenShift when using user + # namespaces). This causes systemd-tmpfiles(8) to fail, as a + # consequence of systemd's path processing routines which reject + # this scenario. Therefore we provide a way to substitute + # systemd-tmpfiles with a "clone" program. + # + SYSTEMD_TMPFILES = os.environ.get( + 'IPA_TMPFILES_PROG', RHELPathNamespace.SYSTEMD_TMPFILES) + paths = RHELContainerPathNamespace()