compose: Support "preserve-passwd" option (enabled by default) #79
Conversation
The checking code from #56 landed, and started triggering for me on the `dockerroot` user. It's nice to know it works. Then the issue is... "what now"? It turns out in the case of `dockerroot` it's actually unused, so we could fix this by deleting it. But in general we need to support dynamic uids/gids/. And we can't yet take a hard dep on #49. So this patch changes things so we take a copy of the passwd/group data from the previous commit. Any users subsequently added in the *new* commit will be additive. Closes: coreos#78
|
ACK. Looks fine, one thing though: When GFile is creating the /etc/passwd and /usr/lib/passwd I assume the SELinux contexts will be wrong/bad, and I'm not sure that rpm will fix them if they preexist ... so can you check that is true? Also are planning on doing a preserve-group option too or merge it in here? (I can't think of a reason to preserve one and not the other ... indeed, I imagine stuff would be confused) |
|
We currently ignore all SELinux labeling that RPM does; ostree has built in SELinux support, and it labels everything at the end. We do pick up file capabilities though. And remember that we don't actually have |
compose: Support "preserve-passwd" option (enabled by default)
I swear I tested this, but anyways coreos#79 wasn't quite right. We need to look at /usr/etc/{passwd,group} for previous data. We happily noticed there was no /etc/passwd in the tree, then proceeded to do the merge and split again, with the result of an empty /usr/etc/passwd in the new tree. That in turn resulted in an empty /etc/passwd in an installed system, i.e. with no "root" user, with obvious bad consequences, namely in my case crashing Anaconda. (Yes, I will write a testsuite for this)
The checking code from #56 landed, and started triggering for me on
the
dockerrootuser. It's nice to know it works. Then the issueis... "what now"?
It turns out in the case of
dockerrootit's actually unused, so wecould fix this by deleting it. But in general we need to support
dynamic uids/gids/. And we can't yet take a hard dep on #49.
So this patch changes things so we take a copy of the passwd/group
data from the previous commit. Any users subsequently added in the
new commit will be additive.
Closes: #78