Packaging concerns for dropping privileges

[bbockelm]

The drop privileges code in #1850 adds a new component, xrdhttp-pelican, to function. This new plugin will take a message from the parent process (via a Unix socket) and do one of three things:

1. If the parent dies unexpectedly (closing the socket), send a SIGTERM to itself.
2. If the parent instructs it to send a signal, sends the specified signal to itself. This will be used for pelican to forward signals to xrootd.
3. If the parent sends a file descriptor, overwrite the current TLS certificates with the one provided by the parent. This allows pelican to update xrootd's host certificates while running (since, after dropping privileges, it cannot arbitrarily overwrite things as root).

This ticket covers the packaging / infrastructure needs for the dropping privileges code to work. We need:

0. Package and ship xrdhttp-pelican as part of the osg-testing repository so we can refer to it from images/Dockerfile and friends. The draft PR in Drop privileges to user pelican if requested #1850 does a build in the container but I think RPM is clearly preferred.
1. (Create pelican user and appropriate directories in RPM packaging #1860) To tweak the pelican RPMs to generated by goreleaser to create the pelican user as a system daemon user.
2. (Create pelican user and appropriate directories in RPM packaging #1860) Tweak the ownership of directories in the created RPM. Any directory that Pelican is expected to write to during runtime must be owned by the new pelican user. Off the top of my head, this includes:
   • The Prometheus database (/var/lib/pelican/monitoring).
   • The various configuration and stateful SQLite databases (/var/lib/pelican).
   • The webconfig file. NOTE: we might want to default this into a different location since it's currently in /etc/pelican; probably will need to change to /etc/pelican/web-config/web-config.yaml. Can defer for now.
   • Shoveler queue directory, /var/spool/pelican.

The code in #1850 will take care of the permissions necessary in /run/pelican.

[matyasselmeci]

@bbockelm can you make a v0.0.3 tag in PelicanPlatform/xrdhttp-pelican ? I need a tag to build it in Koji.

[matyasselmeci]

#1856 should take care of items 1 and 2

[matyasselmeci]

See https://opensciencegrid.atlassian.net/browse/SOFTWARE-6048 for item 0.