Hi josch,
On 26-10-04 07:26:36, Johannes Schauer Marin Rodrigues wrote:
> > newuidmap / newgidmap consult /etc/nsswitch.conf to decide where to
> > get information on allowed sbuids from.
> > The /etc/subuid and /etc/subgid files are only used if the subid filed
> > in /etc/nsswitch.conf is either unset or set to files (see subuid(5)).
> > Otherwise the information is retrived by calling some function in a
> > shared object file derived from the subid value in /etc/nsswitch.conf.
>
> does this change by Simone Caronni do what you ask?
>
> https://gitlab.mister-muffin.de/josch/mmdebstrap/commit/966c51cec2b9ccd87707cbf305a0719d63beacec
It's similar, and it should be enough for my use case.
>From 966c51cec2b9ccd87707cbf305a0719d63beacec:
> + # When /etc/nsswitch.conf delegates the "subid" database to sss(d),
> + # /etc/subuid and /etc/subgid are expected to be empty and the ranges
> + # come from a central identity source (e.g. FreeIPA). In that case use
> + # getsubids(1), which consults whatever sources nsswitch is configured
> + # for, instead of parsing the files directly.
> + my $use_getsubids = 0;
> + if (open($fh, "<", "/etc/nsswitch.conf")) {
> + while (my $line = <$fh>) {
> + next if $line =~ /^\s*#/;
> + if ($line =~ /^\s*subid\s*:\s*(.*?)\s*$/) {
> + my @sources = split /\s+/, $1;
> + if (grep { $_ eq 'sss' } @sources) {
> + $use_getsubids = 1;
> + }
> + last;
> + }
> + }
> + close $fh;
> + }
This explicitly checks nsswitch.conf if subids are delegated to a plugin
called 'sss' (i.e. the one for sss(d)), and only then uses getsubids(1).
This means that this doesn't work for other subid plugins.
My patch doesn't care about the configured plugin and therefore also
delegates the scanning of /etc/subuid and /etc/subgid to getsubids if
the 'files' plugin is used.
If not delegating to getsubids when using the files plugin is preferred,
I propose to instead check if the plugin is not 'files'. Maybe a change
similar to this (untested):
> diff --git a/mmdebstrap b/mmdebstrap
> index 51f47d5..82a3b18 100755
> --- a/mmdebstrap
> +++ b/mmdebstrap
> @@ -1660,7 +1660,7 @@ sub read_subuid_subgid {
> next if $line =~ /^\s*#/;
> if ($line =~ /^\s*subid\s*:\s*(.*?)\s*$/) {
> my @sources = split /\s+/, $1;
> - if (grep { $_ eq 'sss' } @sources) {
> + if (grep { $_ ne 'files' } @sources) {
> $use_getsubids = 1;
> }
> last;
Regards,
Tobias Wiese
