Hi Tobias,
Quoting Tobias Wiese (2026-10-04 15:47:19)
> From 966c51cec2b9ccd87707cbf305a0719d63beacec:
> > + # When /etc/nsswitch.conf delegates the "subid" database to sss(d),
> > + # /etc/subuid and /etc/subgid are expected to be empty and the ranges
> > + # come from a central identity source (e.g. FreeIPA). In that case use
> > + # getsubids(1), which consults whatever sources nsswitch is configured
> > + # for, instead of parsing the files directly.
> > + my $use_getsubids = 0;
> > + if (open($fh, "<", "/etc/nsswitch.conf")) {
> > + while (my $line = <$fh>) {
> > + next if $line =~ /^\s*#/;
> > + if ($line =~ /^\s*subid\s*:\s*(.*?)\s*$/) {
> > + my @sources = split /\s+/, $1;
> > + if (grep { $_ eq 'sss' } @sources) {
> > + $use_getsubids = 1;
> > + }
> > + last;
> > + }
> > + }
> > + close $fh;
> > + }
>
> This explicitly checks nsswitch.conf if subids are delegated to a plugin
> called 'sss' (i.e. the one for sss(d)), and only then uses getsubids(1).
> This means that this doesn't work for other subid plugins.
>
> My patch doesn't care about the configured plugin and therefore also
> delegates the scanning of /etc/subuid and /etc/subgid to getsubids if
> the 'files' plugin is used.
>
> If not delegating to getsubids when using the files plugin is preferred,
> I propose to instead check if the plugin is not 'files'. Maybe a change
> similar to this (untested):
>
> > diff --git a/mmdebstrap b/mmdebstrap
> > index 51f47d5..82a3b18 100755
> > --- a/mmdebstrap
> > +++ b/mmdebstrap
> > @@ -1660,7 +1660,7 @@ sub read_subuid_subgid {
> > next if $line =~ /^\s*#/;
> > if ($line =~ /^\s*subid\s*:\s*(.*?)\s*$/) {
> > my @sources = split /\s+/, $1;
> > - if (grep { $_ eq 'sss' } @sources) {
> > + if (grep { $_ ne 'files' } @sources) {
> > $use_getsubids = 1;
> > }
> > last;could you discuss and agree with Simone Caronni (in CC) about the best way forward here? I have no use nor expertise regarding nsswitch.conf and would rely on contributors like you two to tell me what the best way forward would be to allow your use-case for this. Thanks! cheers, josch
signature.asc
Description: signature
