sysusers: add a treefile option in rpm-ostree #4680

HuijingHei · 2023-10-30T08:26:33Z

Add sysusers option in treefile, if true,

turns off nss-altfiles support
disables the passwd / group files migration to /usr/lib

Xref to coreos/fedora-coreos-tracker#155 (comment)

openshift-ci · 2023-10-30T08:26:38Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

HuijingHei · 2023-10-30T13:02:31Z

Build fcos with coreos/fedora-coreos-config#2698, run fcos_groups and fcos_users passed.

[coreos-assembler]$ kola run -E src/config/tests/ ext.config.files.fcos_groups
=== RUN   ext.config.files.fcos_groups
--- PASS: ext.config.files.fcos_groups (42.60s)
PASS, output in tmp/kola/qemu-2023-10-30-0933-16127
[coreos-assembler]$ kola run -E src/config/tests/ ext.config.files.fcos_users
=== RUN   ext.config.files.fcos_users
--- PASS: ext.config.files.fcos_users (42.68s)
PASS, output in tmp/kola/qemu-2023-10-30-0934-16164

docs/treefile.md

cgwalters

So...no opposition to experimenting with this.

However my overall concern is that sysusers won't handle cases where we have a dynamic UID/GID included in the ostree commit/image content.

I think we started to add a check for this as part of the build system.

cgwalters · 2023-10-30T19:53:58Z

rust/src/passwd.rs

+        new_entities.add_passwd_content(rootfs.as_raw_fd(), "usr/lib/passwd")?;
+        new_entities.add_group_content(rootfs.as_raw_fd(), "usr/lib/group")?;
+    } else {
+        new_entities.add_passwd_content(rootfs.as_raw_fd(), "usr/etc/passwd")?;


Is this right though? I thought we'd be relying on systemd-sysusers creating the users/groups on firstboot?

Maybe should add both? Do you mean with empty passwd / group (and no check-passwd/check-groups)? Maybe that is the final goal.

Right, I thought the goal was that we start with an empty passwd file if we were going all-in on sysusers.

cgwalters · 2023-10-30T19:54:15Z

rust/src/passwd.rs

        db.add_group_content(rootfs.as_raw_fd(), "usr/etc/group")?;
-        db.add_group_content(rootfs.as_raw_fd(), "usr/lib/group")?;
+        if has_usrlib_passwd(&rootfs)? {


I think this change can land now if you want

docs/treefile.md

Default is `false`, if `true`: - turns off nss-altfiles support - disables the passwd / group files migration to /usr/lib Xref to coreos/fedora-coreos-tracker#155 (comment)

HuijingHei · 2023-11-01T10:18:52Z

Tried to remove altfiles in composepost_nsswitch_altfiles with passing arg sysusers, but this does not work, find that if checking usr/etc/nsswitch.conf is symlink, then will not update the configuration file (refer to https://github.com/coreos/rpm-ostree/blob/main/rust/src/composepost.rs#L689), maybe transfer to authselect to create the configuration (see https://src.fedoraproject.org/rpms/authselect/blob/rawhide/f/authselect.spec#_315)?

Does this mean should remove altfiles in postprocess?

cgwalters · 2023-11-01T13:47:25Z

I'm pretty sure we need to also figure out how to disable https://src.fedoraproject.org/rpms/systemd/blob/rawhide/f/systemd.spec#_940

Add an environment variable e.g.?

cgwalters · 2023-11-01T13:52:04Z

Also per discussion I'd say this treefile option should also enable RPMOSTREE_EXP_BRIDGE_SYSUSERS

Edit: And if we have this enabled we also ignore (or error out) if the static check-passwd is specified.

HuijingHei · 2023-11-01T14:41:20Z

I'm pretty sure we need to also figure out how to disable https://src.fedoraproject.org/rpms/systemd/blob/rawhide/f/systemd.spec#_940

Add an environment variable e.g.?

Another problem is when installing a package which requires a systemd users, that will also create the user during pre-script, should we also disable it? for example tcpdump:

$ sudo rpm -q --scripts tcpdump
preinstall scriptlet (using /bin/sh):

# generated from tcpdump-sysusers.conf
getent group 'tcpdump' >/dev/null || groupadd -f -g '72' -r 'tcpdump' || :
if ! getent passwd 'tcpdump' >/dev/null; then
if ! getent passwd '72' >/dev/null; then
useradd -r -u '72' -g 'tcpdump' -d '/' -s '/usr/sbin/nologin' -c 'tcpdump' 'tcpdump' || :
else
useradd -r -g 'tcpdump' -d '/' -s '/usr/sbin/nologin' -c 'tcpdump' 'tcpdump' || :
fi
fi 

exit 0

cgwalters · 2023-11-02T14:01:18Z

Tried to remove altfiles in composepost_nsswitch_altfiles with passing arg sysusers, but this does not work, find that if checking usr/etc/nsswitch.conf is symlink, then will not update the configuration file (refer to https://github.com/coreos/rpm-ostree/blob/main/rust/src/composepost.rs#L689), maybe transfer to authselect to create the configuration (see https://src.fedoraproject.org/rpms/authselect/blob/rawhide/f/authselect.spec#_315)?

Ah wow yes...messy. We have "dueling" sources of truth here. I guess for now we could copy the file to /etc and edit it there?

openshift-ci bot added the do-not-merge/work-in-progress label Oct 30, 2023

HuijingHei mentioned this pull request Oct 30, 2023

Add sysusers option in treefile coreos/fedora-coreos-config#2698

Draft

HuijingHei force-pushed the systemd-sysusers branch from 3c76dba to 3fbf784 Compare October 30, 2023 10:11

HuijingHei requested review from jlebon and cgwalters October 30, 2023 12:56

LorbusChris reviewed Oct 30, 2023

View reviewed changes

docs/treefile.md Outdated Show resolved Hide resolved

cgwalters reviewed Oct 30, 2023

View reviewed changes

HuijingHei force-pushed the systemd-sysusers branch from 1a64b58 to ee3f713 Compare October 31, 2023 02:33

HuijingHei changed the title ~~sysusers: add a treefile option in rpm-ostree to turn off nss-altfiles support and the passwd / group files migration to /usr/lib~~ sysusers: add a treefile option in rpm-ostree Oct 31, 2023

HuijingHei commented Oct 31, 2023

View reviewed changes

docs/treefile.md Outdated Show resolved Hide resolved

HuijingHei force-pushed the systemd-sysusers branch from ee3f713 to 3034dc0 Compare October 31, 2023 03:30

HuijingHei added 2 commits October 31, 2023 11:32

Add sysusers option in treefile

ee68159

Default is `false`, if `true`: - turns off nss-altfiles support - disables the passwd / group files migration to /usr/lib Xref to coreos/fedora-coreos-tracker#155 (comment)

passwd.rs: add condition when adding passwd/group content

a9c572a

HuijingHei force-pushed the systemd-sysusers branch from 3034dc0 to a9c572a Compare October 31, 2023 03:35

HuijingHei force-pushed the systemd-sysusers branch 5 times, most recently from ef30c3b to 7401b70 Compare November 3, 2023 08:46

sysusers: Delete altfiles for passwd: and group: entries

6cbfed7

HuijingHei force-pushed the systemd-sysusers branch from 7401b70 to 6cbfed7 Compare November 3, 2023 08:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sysusers: add a treefile option in rpm-ostree #4680

sysusers: add a treefile option in rpm-ostree #4680

HuijingHei commented Oct 30, 2023 •

edited

Loading

openshift-ci bot commented Oct 30, 2023

HuijingHei commented Oct 30, 2023

cgwalters left a comment

cgwalters Oct 30, 2023

HuijingHei Oct 31, 2023

cgwalters Nov 1, 2023

cgwalters Oct 30, 2023

HuijingHei commented Nov 1, 2023 •

edited

Loading

cgwalters commented Nov 1, 2023

cgwalters commented Nov 1, 2023 •

edited

Loading

HuijingHei commented Nov 1, 2023 •

edited

Loading

cgwalters commented Nov 2, 2023

sysusers: add a treefile option in rpm-ostree #4680

Are you sure you want to change the base?

sysusers: add a treefile option in rpm-ostree #4680

Conversation

HuijingHei commented Oct 30, 2023 • edited Loading

openshift-ci bot commented Oct 30, 2023

HuijingHei commented Oct 30, 2023

cgwalters left a comment

Choose a reason for hiding this comment

cgwalters Oct 30, 2023

Choose a reason for hiding this comment

HuijingHei Oct 31, 2023

Choose a reason for hiding this comment

cgwalters Nov 1, 2023

Choose a reason for hiding this comment

cgwalters Oct 30, 2023

Choose a reason for hiding this comment

HuijingHei commented Nov 1, 2023 • edited Loading

cgwalters commented Nov 1, 2023

cgwalters commented Nov 1, 2023 • edited Loading

HuijingHei commented Nov 1, 2023 • edited Loading

cgwalters commented Nov 2, 2023

HuijingHei commented Oct 30, 2023 •

edited

Loading

HuijingHei commented Nov 1, 2023 •

edited

Loading

cgwalters commented Nov 1, 2023 •

edited

Loading

HuijingHei commented Nov 1, 2023 •

edited

Loading