Maybe it is better to have this in debian/maas-common.dirs
On Apr 24, 2014 4:05 AM, "Jeroen T. Vermeulen" <email address hidden> wrote:

> Jeroen T. Vermeulen has proposed merging lp:~jtv/maas/pkg-import-as-maas
> into lp:~maas-maintainers/maas/packaging.
>
> Commit message:
> Packaging changes: import boot resources from celery worker, as the maas
> user, instead of by running the script through sudo.
>
> Requested reviews:
>   MAAS Maintainers (maas-maintainers)
>
> For more details, see:
> https://code.launchpad.net/~jtv/maas/pkg-import-as-maas/+merge/216983
>
> This does require two extra password-less sudo privileges for the maas
> user: to run tgt-admin (which manages iSCSI targets), and to run
> uec2roottar (which loop-mounts image files in order to extract their
> contents).  As far as the codebase is concerned the maas user will no
> longer need sudo privileges to run the import script, but taking away
> privileges can be painful for users who may rely on them; so I kept that
> privilege.
>
> Ownership of the files in /var/lib/maas/boot-resources needs to change,
> but a migration function in the main codebase takes care of that.
>
> A new directory /var/lib/maas/gnupg is used for GPG state, owned by the
> maas user.  I tried setting a full home directory for the maas user, but
> that didn't work: if the user already existed from a previous installation,
> and still had a process running, usermod refused to do the job.  I figure
> it's hard to ensure that there won't be a maas process running (e.g. it
> might be a region controller on the same machine) but also, we don't really
> need a home directory for maas.  All we really need is a place for GPG
> state to go.
>
> I'm not sure I created this directory in the right way.  Maybe
> /var/lib/maas/gnupg should simply be listed somewhere as a directory to be
> created on installation.  Maybe it should be in maas-cluster-controller
> instead of maas-common.  Advice welcome.
>
>
> Jeroen
> --
> https://code.launchpad.net/~jtv/maas/pkg-import-as-maas/+merge/216983
> You are subscribed to branch lp:~maas-maintainers/maas/packaging.
>
> === modified file 'debian/extras/99-maas-sudoers'
> --- debian/extras/99-maas-sudoers       2012-11-21 10:24:48 +0000
> +++ debian/extras/99-maas-sudoers       2014-04-24 07:03:05 +0000
> @@ -1,3 +1,3 @@
>  maas ALL= NOPASSWD: /usr/sbin/service maas-dhcp-server restart
>  maas ALL= NOPASSWD: /usr/sbin/maas-provision
> -maas ALL= NOPASSWD: SETENV: /usr/sbin/maas-import-pxe-files
> +maas ALL= NOPASSWD: SETENV: /usr/sbin/maas-import-pxe-files,
> /usr/sbin/tgt-admin, /usr/bin/uec2roottar
>
> === modified file 'debian/maas-common.postinst'
> --- debian/maas-common.postinst 2013-03-19 21:35:18 +0000
> +++ debian/maas-common.postinst 2014-04-24 07:03:05 +0000
> @@ -7,6 +7,15 @@
>         local group="maas"
>         addgroup --quiet --system "$group" || true
>         adduser --quiet --system --group --no-create-home "$user" || true
> +
> +        # Set up a "GPG home directory" for the maas user.  This is where
> +        # GnuPG can store its state when verifying import boot resources.
> +        # We can't set a permanent home directory for the maas user,
> because
> +        # the user may already have been created by an older version of
> maas;
> +        # usermod won't set a home directory for a user that has processes
> +        # running, as may be the case for maas.
> +        mkdir -p /var/lib/maas/gnupg
> +        chown $user:$user /var/lib/maas/gnupg
>  }
>
>  add_user_group
>
>
>