chown errors in syslog

[Andreas Hasenack]

I have a some chown failures in /var/log/syslog, that come from the many sssd-*.service files' ExecStartPre commands:

Example for the sssd-sudo service, started by sssd-sudo.socket:
# systemctl cat sssd-sudo.service | grep chown
ExecStartPre=-/bin/chown root:root /var/log/sssd/sssd_sudo.log

# grep chown /var/log/syslog
Sep 3 17:26:27 g-adclient1 chown[880]: /bin/chown: cannot access '/var/log/sssd/sssd_sudo.log': No such file or directory
Sep 3 17:32:03 g-adclient1 chown[1118]: /bin/chown: cannot access '/var/log/sssd/sssd_sudo.log': No such file or directory
Sep 3 17:34:58 g-adclient1 chown[1158]: /bin/chown: cannot access '/var/log/sssd/sssd_pam.log': No such file or directory
Sep 3 17:34:58 g-adclient1 chown[1162]: /bin/chown: cannot access '/var/log/sssd/sssd_pac.log': No such file or directory

They are not fatal, as the commands are prefixed with "-", but generate this noise the first time each service is started (they are socket-activated).

All but sudo seem to create a log file eventually, so the next time they start, the file will be there and chown will work, but sudo doesn't seem to create one in the default config, so this error will repeat.

The service file comes like this from upstream:
ExecStartPre=-/bin/chown @SSSD_USER@:@SSSD_USER@ @logpath@/sssd_sudo.log

There is a configure build-time option to run sssd as another user aparrently (which debian and ubuntu do not use):

  --with-sssd-user=<user> User for running SSSD (root)

That is what sets @SSSD_USER@ ultimately, so I guess the chown is really there for when the user is not root.

[Silke Suck (jenandra)]

I had this one as well as the following:

sssd_check_socket_activated_responders[111869]: The nss responder has been configured to be socket-activated but it's still mentioned in the services' line in /etc/sssd/sssd.conf.

After addressing the second one according to https://sssd.io/docs/design_pages/socket_activatable_responders.html by removing the services line from sssd.conf, the complaints about sssd_sudo.log were gone as well.

HTH!