Changes/Authselect Require explicit opt-out

Authselect: Move State Files to /etc

Summary

Authselect will move several files that are currently stored at /var/lib/authselect to /etc/authselect/.state. This does not affect configuration backup, that will be kept at /var/lib/authselect/backups.

The files that will be moved are:

• /var/lib/authselect/dconf-db -> /etc/authselect/.state/dconf-db
• /var/lib/authselect/dconf-locks /etc/authselect/.state/dconf-locks
• /var/lib/authselect/fingerprint-auth /etc/authselect/.state/fingerprint-auth
• /var/lib/authselect/nsswitch.conf /etc/authselect/.state/nsswitch.conf
• /var/lib/authselect/password-auth /etc/authselect/.state/password-auth
• /var/lib/authselect/postlogin /etc/authselect/.state/postlogin
• /var/lib/authselect/smartcard-auth /etc/authselect/.state/smartcard-auth
• /var/lib/authselect/system-auth /etc/authselect/.state/system-auth

Owner

• Name: Pavel Březina
• Email: pbrezina@redhat.com

Current status

• Targeted release: Fedora Linux 36
• Last updated: 2022-01-20
• devel thread
• FESCo issue: <will be assigned by the Wrangler>
• Tracker bug: <will be assigned by the Wrangler>
• Release notes tracker: <will be assigned by the Wrangler>

Detailed Description

These files are used by authselect to detect changes to the system nsswitch and PAM configurations when the configuration is updated with an updated profile using 'authselect apply-changes'.

Unfortunately, the current location conflicts with ostree model where /var is not writable during rpm transaction and this currently blocks compose of ostree systems (see BZ#2034360). At the same time /usr is read-only on client side of ostree-enabled installations therefore the files can not be moved there since it would break authselect on the client side.

Storing these files under /etc/authselect will make authselect work on both server and client side of ostree systems.

Feedback

This change is accepted by ostree system maintainers, see BZ#2034360.

Benefit to Fedora

This makes authselect more compatible with ostree model.

Scope

• Proposal owners: Build authselect with --statedir=/etc/authselect/.state and move files from /var/lib/authselect to the new location. Spec file changes only.

• Other developers: N/A (not needed for this Change)

• Release engineering: #10544

• Policies and guidelines: N/A (not needed for this Change)

• Trademark approval: N/A (not needed for this Change)

• Alignment with Objectives: N/A

Upgrade/compatibility impact

No impact. Files will be moved automatically during update and everything will keep working as prior.

How To Test

1. Authselect keeps working as expected after the upgrade

User Experience

This change is only under the hood, it does not affect user experience.

Dependencies

No dependencies.

Contingency Plan

• Contingency mechanism: N/A (not a System Wide Change)
• Contingency deadline: N/A (not a System Wide Change)
• Blocks release? N/A (not a System Wide Change), Yes/No

Documentation

N/A (not a System Wide Change)

Release Notes

Authselect state files moved from /var/lib/authselect to /etc/authselect/.state.