Is there a rpm command to find the package that created a particular user or particular group?

Question

Given a particular user or particular group, is there a rpm command that returns what package created that particular user or particular group?

Analogous to rpm -q --whatprovides /etc/security/limits.conf returns the package "pam". Is there an rpm command that returns what package generated a particular user?

Most of us already know that the httpd package is associated with the user apache. But there are passwd and group entries that i would like to verify and want to know exactly how they got on my system. Further i would like to know which the security implications of adding another group to a user account.

Something like the following command:

`rpm --query --user apache` would return "httpd"
`rpm --query --group pulse-access` might return pulseaudio

Answer 1

take a look at the pre/post-script parts of the rpms

rpm -q --scripts httpd

other users/groups are "installed" via centos setup (anaconda).

Comments

--scripts is helpful, the following returns a great deal of package scripts having to do with users and groups, but ideally would return just the package names involved in creating the user or group.

rpm -qa --scripts | egrep 'user|group|ids|getent|pass'
rpm -qa --scripts | less does not seem to list any package names, but may be a more formal rpm would help:
rpm --queryformat "%{FILEUSERNAME} %{TRIGGERSCRIPTS} %{TRIGGERSCRIPTPROG}n" --query httpd

does not return a script name and i do not see anything else in rpm --querytags that would help.