On removing users with %postun in RPM SPEC files

The moment you start to write your own SPEC files for creating RPM images, you may be tempted to do the following in the %postun section of the file:

%postun
userdel --force daemonuser 2> /dev/null; true

It seems only logical: in the uninstall section of the RPM package, delete the user that was once used for that package. After all, why would the user be left behind when you uninstall or remove a package?

My advice would be: don't do this. While the logic makes sense, it poses a few problems.

It breaks upgrades

If you install a new version of your RPM package via yum or manually via "rpm -Uvh", the %postun is triggered. Why? Because when upgrading what actually happens is your package manager will install the new RPM package and then remove the previous version, thus triggering the %postun. Since the delete of the previous version happens last, with the configuration above the user running your application is removed from the system.

It poses a security threat

Assuming you've added users in your SPEC file to manage your application, it could pose a security leak when removing that user in the %postun section. After all, if afterwards a new user is created and it is given the UID of that deleted user, it has full access to the configuration or log files that may be left behind and are only readable by that user.

Granted, chances are slim, but your user can add sensitive configuration files that your RPM file knows nothing about.

Still need it? Check the $1 variable

If you still want to delete a user upon uninstall of your RPM but not when upgrading, you can evaluate the $1 variable in %postun. If that first argument is 1, the action is an upgrade. If it's 0, it's a removal of your package. Hence, the code snippet from above should be changed to the following.

%postun
if [ "$1" = "1" ]; then
   userdel --force daemonuser 2> /dev/null; true
fi

If you have any other comments on %postun and users I'd love to hear them.

Looking for help?

Tired of fixing all these tech-problems yourself? We've got an excellent team at Nucleus, a top-class Belgian hosting provider, that can help you. Discover our Managed Hosting, where skilled engineers manage your servers and keep them up-to-date, so you can focus on your core business. We use a variety of Configuration Management Systems such as Puppet to make sure every config is reviewed, unit-tested and guaranteed to be working.

Want to get in touch? Find me as @mattiasgeniar on Twitter or via the contact-page on my blog.

Tagged with: ,
Posted in Devops, linux
2 comments on “On removing users with %postun in RPM SPEC files
  1. Asif says:

    shouldn’t it be $1 == 0 as you are confining it to a rpm erase not update?

  2. Oleg says:

    Yes thats right, it shoudl be:

    if [ "$1" == 0 ]; then
    userdel –force daemonuser 2> /dev/null; true
    fi

    because you want to delete an User only if you uninstall the package and do not update it.

    Hence the Code from Matthias does exactly the thing he wanted to avoid :)

Leave a Reply

Your email address will not be published. Required fields are marked *

*

*

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>