mirror of
https://github.com/kanidm/kanidm.git
synced 2025-04-17 15:55:40 +02:00
b88b6923eb
The implementation of the unixd cache relies on inotify to detect changes to files in /etc so that we know when to reload the data for nss/passwd. However, the way that groupadd/del and other tools work is they copy the file, change it, and then move it into place. It turns out that william of the past didn't realise that inotify works on inodes not paths like other tools do (auditctl for example). As a result, when something modified /etc/group or another related file, the removal was seen, but this breaks notifications on any future change until you reload unixd. To resolve this we need to recursively watch /etc with inotify - yep, that's correct. We have to watch everything in /etc for changes because it's the only way to pick up on the add/remove of files. But because we have to watch everything, we need permissions to watch everything. This forces us to move the parsing of the etc passwd/group/shadow files to the unixd tasks daemon - arguably, this is the correct place to read these anyway since that is a high priv (and locked down) daemon. Because of this, we actually end up solving the missing "shadow" group on debian issue, and probably similar on the BSD's in future. In order to make my life easier while testing I also threw in a makefile that symlinks the files to needed locations for testing. It has plenty of warnings as it should. Fixes #3499 Fixes #3407 Fixes #3249
20 lines
942 B
Makefile
20 lines
942 B
Makefile
|
|
current_dir = $(shell pwd)
|
|
|
|
dev_install:
|
|
@ echo "WARNING: THIS WILL BREAK EXISTING UNIXD INSTALLS"
|
|
@ echo "ctrl-c now if this is not what you want"
|
|
@ read
|
|
@ echo "LAST CHANCE"
|
|
@ sleep 5
|
|
ln -s -f $(current_dir)/../platform/opensuse/kanidm-unixd.service /etc/systemd/system/kanidm-unixd.service
|
|
ln -s -f $(current_dir)/../platform/opensuse/kanidm-unixd-tasks.service /etc/systemd/system/kanidm-unixd-tasks.service
|
|
ln -s -f $(current_dir)/../target/debug/kanidm-unix /usr/sbin/kanidm-unix
|
|
ln -s -f $(current_dir)/../target/debug/kanidm_ssh_authorizedkeys /usr/sbin/kanidm_ssh_authorizedkeys
|
|
ln -s -f $(current_dir)/../target/debug/kanidm_unixd_tasks /usr/sbin/kanidm_unixd_tasks
|
|
ln -s -f $(current_dir)/../target/debug/kanidm_unixd /usr/sbin/kanidm_unixd
|
|
ln -s -f $(current_dir)/../target/debug/libpam_kanidm.so /lib64/security/pam_kanidm.so
|
|
ln -s -f $(current_dir)/../target/debug/libnss_kanidm.so /usr/lib64/libnss_kanidm.so.2
|
|
|
|
|