core/dracut/ignition-ostree: add ignition-ostree-sysusers service

[lucab]

This introduces a new ignition-ostree-sysusers.service, which takes
care of poulating users and groups on the target sysroot before the
Ignition files stage.

[jlebon]

This looks good to me! With this, are you able to refer to users/groups created via systemd-sysusers in your Ignition config?

[lucab]

@jlebon yes, although testing this right now is skewed due to the pending dnsmasq fix at https://src.fedoraproject.org/rpms/dnsmasq/pull-request/6. I can add a regression test on top once that RPM is fixed.

On a custom image without dnsmasq, the result looks like this:

# grep zincati /usr/lib/passwd /etc/passwd
/etc/passwd:zincati:x:979:979:Zincati user for auto-updates:/:/usr/sbin/nologin

# jq .storage.files[0] /run/ignition.json 
{
  "group": {},
  "path": "/etc/zincati/config.d/empty.toml",
  "user": {
    "name": "zincati"
  },
  "contents": {
    "source": "data:,%23%20Empty%20placeholder%0A",
    "verification": {}
  },
  "mode": 420
}

# ls -laZ /etc/zincati/config.d/empty.toml
-rw-r--r--. 1 zincati root system_u:object_r:etc_t:s0 20 Dec 11 16:22 /etc/zincati/config.d/empty.toml

[lucab]

Added a test, dropped RFC, this should be ready to merge.

[lucab]

/cc @travier FYI this touches into sysusers.d topic, but should be already fitting into future reworks.

[travier]

As far as I understand, we could directly call systemd-sysusers --root=/sysroot. Any reason not to do that? See: #774 (comment)

[travier]

This looks good to me! With this, are you able to refer to users/groups created via systemd-sysusers in your Ignition config?

I don't think this will work as this would require splitting the Ignition stage that creates users/groups from the files stage to make a similar call like the one included here to create the users. This will only setup users/groups that are declared in sysusers files in the ostree commit but not included in passwd/shadow/group.

[jlebon]

This looks good to me! With this, are you able to refer to users/groups created via systemd-sysusers in your Ignition config?

I don't think this will work as this would require splitting the Ignition stage that creates users/groups from the files stage to make a similar call like the one included here to create the users. This will only setup users/groups that are declared in sysusers files in the ostree commit but not included in passwd/shadow/group.

Are you talking about the case where the Ignition config adds sysusers drop-in configs and in the same Ignition config there are files which reference those users/groups as owners? Hmm, do we really need to handle this? Ignition already provides a declarative way of creating system users/groups and it creates users/groups before creating files.

[travier]

I don't think this will work as this would require splitting the Ignition stage that creates users/groups from the files stage to make a similar call like the one included here to create the users. This will only setup users/groups that are declared in sysusers files in the ostree commit but not included in passwd/shadow/group.

Are you talking about the case where the Ignition config adds sysusers drop-in configs and in the same Ignition config there are files which reference those users/groups as owners? Hmm, do we really need to handle this? Ignition already provides a declarative way of creating system users/groups and it creates users/groups before creating files.

Yes. From coreos/fedora-coreos-tracker#155, one of the option is to move to a fully sysusers defined list of users for the system for rpm-ostree & Ignition. This option could enable first boot removal among other things.

[travier]

I think we need a larger design discussion for this topic but this has not happened yet as this has not been a priority so far. But this should probably not prevent this PR from being merged.

[cgwalters]

Did it come up to have Ignition have support for this built in? It really feels like we're doing this special thing behind its back here that other Ignition users would want.

Ignition still carries code to use chroot() for getent lookups which is a "poor-man's" containerization.

[cgwalters]

This would probably be a good thing to live in rdcore (and in theory in the future it could be a crate shared between rdcore and rpm-ostree).

Not a blocker though.

[cgwalters]

Also I agree strongly with #774 (comment)

[lucab]

@cgwalters it indeed started with coreos/ignition#1153 on Ignition side but got redirected here.

[dustymabe]

bump