From 5708f3595e143ced0c4030ebae0cd85168ea0d6c Mon Sep 17 00:00:00 2001
From: Jason Ertel <jason.ertel@securityonionsolutions.com>
Date: Tue, 27 Sep 2022 17:27:28 -0400
Subject: [PATCH] Avoid overwriting the file inode since it's mapped into a
 running container

---
 salt/common/tools/sbin/so-user | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/so-user b/salt/common/tools/sbin/so-user
index 0a287aa7c..737efb7f0 100755
--- a/salt/common/tools/sbin/so-user
+++ b/salt/common/tools/sbin/so-user
@@ -573,7 +573,7 @@ function deleteUser() {
   rolesTmpFile="${socRolesFile}.tmp"
   createFile "$rolesTmpFile" "$soUID" "$soGID"
   grep -v "$identityId" "$socRolesFile" > "$rolesTmpFile"
-  mv "$rolesTmpFile" "$socRolesFile"
+  cat "$rolesTmpFile" > "$socRolesFile"
 }
 
 case "${operation}" in