illumos gate

postgres user is also used by RBAC profile:

Postgres Administration:solaris:cmd:::/usr/postgres/8.2/bin/initdb:uid=postgres
Postgres Administration:solaris:cmd:::/usr/postgres/8.2/bin/ipcclean:uid=postgres
Postgres Administration:solaris:cmd:::/usr/postgres/8.2/bin/pg_controldata:uid=postgres
Postgres Administration:solaris:cmd:::/usr/postgres/8.2/bin/pg_ctl:uid=postgres
Postgres Administration:solaris:cmd:::/usr/postgres/8.2/bin/pg_resetxlog:uid=postgres
Postgres Administration:solaris:cmd:::/usr/postgres/8.2/bin/postgres:uid=postgres
Postgres Administration:solaris:cmd:::/usr/postgres/8.2/bin/postmaster:uid=postgres

The Postgres user should probably be delivered by the Postgres package (which illumos does not distrib). The RBAC profile is delivered via SUNWpostgr-8*-server-data-root (or whatever IPS calls it).

Seems like a bug against the SUNW package, not against ON.

If we're going to pull postgres out, we should pull other non-distributed users as well, though.

I have no strong feelings about this, regardless.

diff -r 61ea578f8715 usr/src/cmd/Adm/group
--- a/usr/src/cmd/Adm/group     Mon Aug 30 23:48:20 2010 -0700
+++ b/usr/src/cmd/Adm/group     Tue Aug 31 06:44:03 2010 -0400
@@ -20,7 +20,6 @@
 mysql::70:
 openldap::75:
 webservd::80:
-postgres::90:
 slocate::95:
 unknown::96:
 nobody::60001:
diff -r 61ea578f8715 usr/src/cmd/Adm/sun/passwd
--- a/usr/src/cmd/Adm/sun/passwd        Mon Aug 30 23:48:20 2010 -0700
+++ b/usr/src/cmd/Adm/sun/passwd        Tue Aug 31 06:44:03 2010 -0400
@@ -18,7 +18,6 @@
 mysql:x:70:70:MySQL Reserved UID:/:
 openldap:x:75:75:OpenLDAP User:/:
 webservd:x:80:80:WebServer Reserved UID:/:
-postgres:x:90:90:PostgreSQL Reserved UID:/:/usr/bin/pfksh
 svctag:x:95:12:Service Tag UID:/:
 unknown:x:96:96:Unknown Remote UID:/:
 nobody:x:60001:60001:NFS Anonymous Access User:/:
diff -r 61ea578f8715 usr/src/cmd/Adm/sun/shadow
--- a/usr/src/cmd/Adm/sun/shadow        Mon Aug 30 23:48:20 2010 -0700
+++ b/usr/src/cmd/Adm/sun/shadow        Tue Aug 31 06:44:03 2010 -0400
@@ -18,7 +18,6 @@
 mysql:NP:::::::
 openldap:*LK*:::::::
 webservd:*LK*:::::::
-postgres:NP:::::::
 svctag:*LK*:6445::::::
 unknown:*LK*:::::::
 nobody:*LK*:6445::::::

Right. Postgres users, RBAC profiles, and other administrative data should be delivered with postgres itself. There is absolutely no reason for these things to be in the "core" or "base" of the operating system. That's what I want to see fixed.

Bryan, did you ever do a nightly build with these changes (and have you installed the resulting bits)?

Bryan: Informationally, since none of this applies to postgres:

These (and all "default") users used to be delivered by ON because it was the only practical way to do it. You could, indeed, remove every use ON doesn't explicitly need, though you would want to make sure that the packages that do need them delivered the users first (or you're going to break a bunch of stuff for people who onu).

You could remove many users which ON does need from the base files, but care is required due due to bootstrapping concerns (you need enough base stuff pre-existing to facilitate adding the remaining users).

Garrett: The comment immediately preceding yours says that he did, yes...