We will address this shortvcoming in SSSD 1.2

In the meantime, it can also be resolved by modifying the {{{/etc/init.d/sssd}}} init script and removing {{{-f}}} from the options when starting the SSSD. This will prevent it from writing to logs.

milestone: NEEDS_TRIAGE => SSSD 1.2

Correction, I wasn't thinking straight. You are correct that we must have write access on /var/lib/sss for writing to the sysdb cache and the config db.

The workaround that I mentioned in my previous comment is not valid for this.

The one-line fix I posted should do the trick. Thanks.

Fields changed

owner: somebody => jhrozek

Hi,

I have packaged the file as you suggested and my testing shows that SSSD is now able to start on a ro root fs and perform basic operation - I tested LDAP identity and Kerberos authentication.

I have built testing packages - if you have time to test your usecase, any feedback would be mostly welcome.

Today's master plus the patch:
http://koji.fedoraproject.org/koji/taskinfo?taskID=2069537
http://koji.fedoraproject.org/koji/taskinfo?taskID=2069542

status: new => assigned

Sorry for the link formatting. It should have read:

- F12 scratch builds - http://koji.fedoraproject.org/koji/taskinfo?taskID=2069537
- F13 scratch builds - http://koji.fedoraproject.org/koji/taskinfo?taskID=2069542

I haven't had a chance to test the RPM you just packaged, but I manually added /etc/rwtab.d/sssd about a week ago. Over the last week, I've been testing with 25 machines with readonly root over NFS, and everything is working well. I'll let you know if I run into any problems, and I'll try to test the RPM itself sometime soon, although it might be a few days before I get a chance. Thanks for addressing this problem so quickly.

Fixed in a6f5518219fb3358595852eeaa9ad9c3e0410821

fixedin: => 1.2.0
resolution: => fixed
status: assigned => closed

Fields changed

rhbz: => 0

SSSD is moving from Pagure to Github. This means that new issues and pull requests
will be accepted only in SSSD's github repository.

This issue has been cloned to Github and is available here:
- https://github.com/SSSD/sssd/issues/1470

If you want to receive further updates on the issue, please navigate to the github issue
and click on subscribe button.

Thank you for understanding. We apologize for all inconvenience.