Non-exist group "wheel" in /usr/lib/tmpfiles.d/systemd.conf

[Xi Ruoyao]

I just built a fresh new LFS-20181109-systemd and see something strange in the journal:

systemd-tmpfiles[185]: Failed to parse ACL "d:group:adm:r-x,d:group:wheel:r-x": Invalid argument. Ignoring

This is because we don't have a "wheel" group, but systemd-239 assume it is existing. We can create this group, or remove it from systemd.conf with some sort of sed.

[Xi Ruoyao]

We should add meson option '-Dwheel-group=false' to tell systemd we don't have wheel group.

[DJ Lucas]

I'm not too attached to it, but I see wheel more and more (likely as a result of systemd). I do use it for sudoers locally. I just want to make sure it is discussed before killing it off from the get go. Thoughts?

[Bruce Dubbs]

I don't really see a problem creating a wheel group when we create /etc/group. Looking at what we have in LFS and BLFS, I'd suggest a gid of 97 or possibly 100.

[Douglas R. Reno]

I agree here - let's put it in /etc/group

GID of 97 would fit the best IMO. It would make us the most consistent with other distros (my CIT-132 class has us examining the differences between 11 different distros, and they all have a wheel group below GID 100).

[Xi Ruoyao]

If we add the wheel group we should also introduce pam_wheel module of Linux-PAM in BLFS.

[DJ Lucas]

I suppose for su, we'd do auth required pam_wheel.so to prevent misconfiguration of sudo allowing regular su access. For chage and the rest, these are all root only as of now and require sudo. Would it be appropriate to do an early {auth,account} sufficient pam_wheel.so before their -system counterparts for all of the default binaries that we create a specific configuration? The same does not apply to sudo as you would use its configuration directly, though I'd probably add the wheel group to the default configuration there.

[DJ Lucas]

To clarify, this configuration would allow members of the wheel group do unsightly things like 'sudo su' but I think that's the whole point of the module, if you have wheel access, you had best know what you are doing anyway.

[Douglas R. Reno]

Fixed at r11487