shadow, passwd,group: reallocate users/groups between static/dynamic (sumo) #326
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
At distro build time, the 'useradd-staticids' extension results in all `useradd` or `groupadd` commands being rewritten to use an explicit a distro-defined UID/GID. This is desirable so that we get consistent results regardless of package build order. However, many of these users do not exist in /etc/passwd or /etc/group at runtime until their associated packages are installed, which means that we can run into a situation where a package built from outside our distro build ecosystem (such as NIFeeds) invokes "useradd" and ends up claiming, simply by virtue of being next-in-sequence, an ID that a distro-built package is now hardcoded to expect to use. For system users `useradd` and `groupadd` pick the lowest number that isn't in use. Because of this, in practice, the first `useradd` that would occur on-target would pick the next-lowest from `lldpd` (362), which had been assigned to `redis` (361), so a later install of redis would then try to use an ID already in use. To deal with this, partition the existing range almost-nearly in half. The `lvuser` and `webserv` users need to stay at 500 and 501 and `ni` at 500 due to legacy reasons, but we can say that anything higher than those should be free for automatic on-target `useradd` usage, and below used for things built as part of the distro. Signed-off-by: Brenda Streiff <brenda.streiff@ni.com>
Reorder the group and passwd files used for static assignment.
Several users changed IDs:
netdev 999 -> 350
messagebus 998 -> 349
avahi 997 -> 348
avahi-autoipd 996 -> 347
docker 499 -> 346
libvirt 498 -> 345
sshd 497 -> 344
rwhod 496 -> 343
opensaf 495 -> 342
tracing 494 -> 341
Several groups changed IDs; consistency was kept with corresponding UIDs.
messagebus 999 -> 349
avahi 998 -> 348
sshd 498 -> 344
rshod 497 -> 343
opensaf 496 -> 342
Changing these users was done to rearrange IDs to fit into the 100-500
range, which is where we want to have statically-defined-via-OE users
and groups. It also resolves two conflicts, which is that both `openvpn`
and `docker` were at 499 and `niwscerts` and `libvirt` were both at 498.
The file also has been changed to put IDs in sorted order. Descending
order was chosen because the file was already mostly in descending order
and this minimizes diff noise. Keeping this in order is an aid to not
create conflicts in the future.
Signed-off-by: Brenda Streiff <brenda.streiff@ni.com>
Add a test within the recipe to ensure that logins.def declares no IDs that are within the ranges defined by login.defs (`[UG]ID_MIN` -> `MAX` and `SYS_[UG]ID_MIN` -> `MAX`). Additionally, the test ensures that the files remain in sorted order. This is intended as a safety check to ensure that we do not statically declare a user/group that will conflict with the dynamic range, and also that we do not decare them in such a way that they will conflict with each other. Signed-off-by: Brenda Streiff <brenda.streiff@ni.com>
amstewart
approved these changes
Feb 9, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Cherry-pick the same set of commits as in #324 to resolve same issues in sumo.