migrations: Add support for adding subuids and subgids to users #7
Conversation
|
Before reviewing the code, I don't think I like the logic suggested in #6. What's been proposed here is to add a certain range of subuids/gids (I don't know where the value come from, but that's not relevant now), ignoring user's preferences in /etc/login.defs. /etc/login.defs is under the total control of the user since it's /etc, and this file may specify (I'm copying what Fedora ships for reference): Suppose COUNT is zero. Aren't we overriding what the user requested? |
|
/etc/login.defs is a low-level, system-managed file in Solus. It has just not been made stateless yet. The goal is to ship a sane set of defaults, such that subuids and subgids just work ootb. |
|
FWIW Gentoo is doing similar to this |
| @@ -85,6 +85,47 @@ func (c *Context) FilterUsers(filters ...string) (filtered []User) { | |||
| return filtered | |||
| } | |||
|
|
|||
| // GetRootUser gets the root user | |||
| func (c *Context) GetRootUser() User { | |||
There was a problem hiding this comment.
FYI: I know it's not because of you, so just leaving a comment: a "context" is very C-like and not a great tool to make code readable, since organization-wise it's a stash you throw anything in. A "user" package would probably be better on topic.
|
Since past me was a jerk and didn't post a migration file anywhere, here is what I just re-created to test this with: description = """
Adds subuids and subgids to root and all users, if necessary.
We typically want this to enable support for rootless container like solutions e.g. podman OOTB. The subgid/subuid files will only be created, and the commands adding the ids only run, if they are not already present. After creation, these files should be maintained by shadow.
"""
[[add-subids]]
group = "users"
range-start = 1000000
range-end = 1065535Test plan
|
This comment was marked as resolved.
This comment was marked as resolved.
Sorry, something went wrong.
|
Now that I am copying in the new qol-assist binary to /usr/sbin (and not /usr/bin like before -- derp), things appear to work: |
Ensure that we use atomic file operations for subgid and subuid files. Signed-off-by: Evan Maddock <[email protected]>
ermo
force-pushed
the
6-enable-support-to-retroactively-add-users-to-etcsubuid-and-etcsubgid-files
branch
from
edf6acd to
27e7f19
Compare
ermo
deleted the
6-enable-support-to-retroactively-add-users-to-etcsubuid-and-etcsubgid-files
branch
Adds a migration task to add subuids and subgids to users in a group, plus root. If the /etc/ files exist, the commands will not be executed.
Fixes #6
Tested in a fresh Solus VM that did not have the /etc/ subid files and noted that the files were created after migrations were run.
Signed-off-by: Evan Maddock [email protected]