sysusers: remove adm entries and start qemu disk failed with useradd: group 'adm' does not exist

[HuijingHei]

Refer to coreos/rpm-ostree#49 (comment), do testing like this:

1. Remove adm line in group and passwd
2. Build FCOS, which will create adm user and group

systemd.post: Creating group 'adm' with GID 4.
systemd.post: Creating user 'adm' (adm) with UID 3 and GID 4.
systemd.post: /etc/gshadow: Group "adm" already exists.

3. Boot the qemu disk using cosa run --devshell

Actual result:
Check that boot failed with log useradd: group 'adm' does not exist, and check /etc/group has adm (but can not find adm in /etc/passwd, no idea where the user saved)

Jul 06 05:42:48 localhost ignition[1091]: files: ensureUsers: op(1): [started]  
creating or modifying user "core"
Jul 06 05:42:48 localhost ignition[1091]: files: ensureUsers: op(1): executing: 
"useradd" "--root" "/sysroot" "--create-home" "--password" "*" "--comment" "Core
OS Admin" "--groups" "adm,sudo,systemd-journal,wheel" "core"
Jul 06 05:42:48 localhost ignition[1091]: files: ensureUsers: op(1): [failed]   
creating or modifying user "core": exit status 6: Cmd: "useradd" "--root" "/sysr
oot" "--create-home" "--password" "*" "--comment" "CoreOS Admin" "--groups" "adm
,sudo,systemd-journal,wheel" "core" Stdout: "" Stderr: "useradd: group 'adm' doe
s not exist\n"
Jul 06 05:42:49 localhost ignition[1091]: files failed

:/root# grep adm /etc/group
adm:x:4:
:/root# grep adm /etc/passwd
---nothing output
:/root# ls /usr/lib/passwd /usr/lib/group
ls: cannot access '/usr/lib/passwd': No such file or directory
ls: cannot access '/usr/lib/group': No such file or directory

[HuijingHei]

Maybe it is related to coreos/ignition#1596, but seems a little different that I can ensure the adm group is in /etc/group(see above result in # grep adm /etc/group), but the error log said useradd: group 'adm' does not exist.

[cgwalters]

There's layers of complexity here. systemd-sysusers was designed to run from the real root. But Ignition wants to configure things from the initramfs.

Probably what we need to do first is add a systemd unit which keys off the firstboot and runs systemd-sysusers --root /sysroot before Ignition runs. That I believe would be safe to do now.

There's a distinct but slightly related problem in that it's quite common for things in the initramfs to reference user and groups and today many of those fail because we don't have altfiles setup in the initramfs (which is its own bug).

[travier]

Linking to #155. We should probably keep the conversation in a single place.

[cgwalters]

OK sure, we can dedup on #155