From Fedora Project Wiki

Authselect: Enable nss-altfiles for all installations

This is a rejected Change proposal for Fedora Linux.
This document represents a proposed Change that has been rejected or withdrawn as part of the Changes process. This page is preserved for historical record.

Summary

Currently, authselect users can enable nss-altfiles in nsswitch.conf using "with-altfiles" feature. This proposal is to remove the feature and hardcode nss-altfiles support in nsswitch.conf in all shipped profiles, making it required.

Owner


Current status

Detailed Description

Currently, non-ostree systems (e.g. Fedora Workstation) have nss-altfiles nsswitch.conf module optional in authselect profiles. Users can enable this module by calling "authselect enable-feature with-altfiles" or directly when selecting the profile "authselect select $profile with-altfiles".

However, the nss-altfiles nsswitch.conf module is required to be enabled on ostree systems (e.g. Fedora Silverblue) and must not be disabled there to make system users available to the system. This is currently handled by authselect in %post scriptlet that modifies the shipped profiles and hardcodes nss-altfiles in them.

This solution, however, makes authselect different on ostree and non-ostree systems. The history also showed that it is quite fragile and easy to break with modifications to the profiles. The intention is to hardcode nss-altfiles on both ostree and non-ostree, making authselect install exactly the same files on both distribution types.

Feedback

None.

Benefit to Fedora

Both ostree and non-ostree Fedora releases will ship exactly the same authselect content.

Scope

  • Proposal owners: Do the work in upstream and release it in Fedora.
  • Other developers: None.
  • Policies and guidelines: N/A (not needed for this Change)
  • Trademark approval: N/A (not needed for this Change)
  • Alignment with the Fedora Strategy:

Upgrade/compatibility impact

None. Upgrade path will be handled by authselect.

Only the profiles shipped inside authselect rpm are affected. If a user uses a custom profile, that provides its own nsswitch.conf template with "with-altfiles" feature defined, this change does not affect the custom profile. The feature will still be available for the custom profile.

If a user use custom profile that symlinks nsswitch.conf to a shipped profile (e.g. the profile was created with "authselect create-profile --symlink-nsswitch") then the "with-altfiles" feature will no longer be available and the nsswitch.conf content will be updated with the new content from the rpm. This is however the intention of having the symlink inside the custom profile.


Early Testing (Optional)

Do you require 'QA Blueprint' support? N

How To Test

  1. Check that with-altfiles is no longer available in the profiles
  2. Check that "altfiles" is present in generated /etc/nsswitch.conf


User Experience

Authselect package will require nss-altfiles package (~46KiB) which will be automatically installed and nss_altfiles module will be enabled for all users for passwd and group database. If the user have /usr/lib/passwd and /usr/lib/group then users and groups defined in these files will be loaded. If the files are missing, nothing happens and the change will be completely seamless.

Dependencies

None.


Contingency Plan

  • Contingency mechanism: (What to do? Who will do it?) N/A (not a System Wide Change)
  • Contingency deadline: N/A (not a System Wide Change)
  • Blocks release? N/A (not a System Wide Change), Yes/No


Documentation

N/A (not a System Wide Change)

Release Notes

The "with-altfiles" feature has been removed from all authselect profiles. The nss-altfiles support is now enabled and can not be disabled.

Retrieved from "https://fedoraproject.org/w/index.php?title=Changes/Enable_nss-altfiles_for_all_installations&oldid=781949"