rpm -e package does not remove entry from /etc/passwd

Question

I've been playing around with Splunk and got some questions:

1. I have installed it using

   rpm -iv splunk-7.2.3-06d57c595b80-linux-2.6-x86_64.rpm

2. I removed it next using

rpm -e splunk-7.2.3-06d57c595b80.x86_64

My question is, why didn't rpm remove the Splunk user from /etc/passwd ? Also I'm a bit puzzled why removing via splunk-7.2.3-06d57c595b80-linux-2.6-x86_64.rpm did not work (but the installation did) and I had to get the actual package name with rpm -qa | grep splunk first?

Is this related to the Splunk rpm package or rather standard?

Answer 1

rpm packages consist of a bunch of files and optionally a group of scripts (pre/postinstall pre/postremove pre/postupgrade verify)

You can use the --list option to show what files are part of the package. These will be removed when you --erase the package.

rpm -qipl package.rpm

You can also include --scripts to dump the contents of the scripts. There isn't a whole lot of standardized templates or enforcement on how install / remove scripts work, so it's really up to the package maintainer. But you can certainly dump the --scripts of a package to discover exactly what an RPM is doing to your system so you can better write your own cleanup scripts.

rpm -qi --scripts package.rpm

You might even consider installing with --noscripts if you just need some files from an rpm and don't want or don't trust the maintainer to dink with the configuration of your system.

Answer 2

Not removing a user together with a package is a standard.

Thomas already provided nice explanation in comments and linked this nice document https://ma.ttias.be/on-removing-users-with-postun-in-rpm-spec-files/

However, there is another reason. Many admins rely on LDAP or NIS to provide users to the system. And even before installing package which creates new user, they will first add that user to their LDAP. This is the reason why new users are created using:

getent passwd USERNAME >/dev/null || \
    useradd -r -g GROUPNAME -d HOMEDIR -s /sbin/nologin ...

i.e. before the user is created, the package should always check if the user already has been created.

And of course, you simply cannot remove LDAP user from a client system. So simple userdel may likely fail. So it is up to the admin to remove the user - using the tools he uses for user management.