Re: [OE-core] [RFC] incorrect parsing of sysusers.d in rootfs generation

[Louis Rannou <lrannou@baylibre.com>]

Hello, below is a counter proposition including some work in the systemd 
recipe,



On 08/06/2023 13:56, Louis Rannou wrote:
> 
> 
> On 08/06/2023 12:36, Richard Purdie wrote:
>> On Thu, 2023-06-08 at 12:28 +0200, Louis Rannou wrote:
>>> Hello,
>>>
>>> On 08/06/2023 11:19, Richard Purdie wrote:
>>>> On Wed, 2023-06-07 at 17:16 +0200, Louis Rannou wrote:
>>>>> Hello again,
>>>>>
>>>>> a python solution could be one below.
>>>>>
>>>>> Also, I found that most of users/groups defined there are redundant as
>>>>> they already exist (such as root). I guess they are defined from
>>>>> base-passwd. I am not sure which recipe (base-passwd or systemd) 
>>>>> should
>>>>> have the precedence on this. If it's base-passwd, perhaps this
>>>>> postcommand should check first if the user does already exist.
>>>>
>>>> I'd say base-passwd should likely be the winner but we should probably
>>>> error if there is a conflict between what sysusers.d and base-passwd
>>>> are defining.
>>> There will be some conflict. As an example the root home directory in
>>> sysusers.d is /root.
>>>
>>> Some others users/groups defined in sysusers.d files are already created
>>> in recipes with the useradd class (such as systemd-resolved,
>>> systemd-network who are defined in the systemd recipe).
>>>
>>> In the end, almost all users/groups in sysusers.d/* already exist.
>>> Perhaps it's a wrong way to parse this file to add users. In my opinion,
>>> we should only parse this file to check users/groups are already created
>>> and raise an error if one is missing.
>>
>> Perhaps lets start there. The fact different bits of systemd are
>> configured with different home directories is a problem we should
>> really fix though and ultimately that probably should be an error too.
> 
> Concerning the root home directory, I asked a question to systemd 
> https://github.com/systemd/systemd/issues/27959 and LP answered he 
> doesn't want to support a customizable root home directory.
> 
> Should we patch systemd to match our configuration, or should we change 
> our configuration to match systemd's will...
> 
> Louis

The more I look at this and at #9497 (which gives the reason of this 
command), the more I think the problem was not correctly handled.

sysusers.d is made to create missing users at runtime with the 
systemd-sysusers service.

First of all, that means there is a wrong runtime configuration as long 
as /etc/{passwd, gpasswd, shadow, gshadow} do not match sysusers.d/*.conf

I think it is fine to check during the build that sysusers.d/*.conf do 
match configuration for users/groups created during build, but we should 
not create users and groups at this stage because missing users will be 
created at runtime.

I think sysusers/*.conf should be provided with the systemd recipe so 
they match our configuration (such as ROOT_HOME for the root directory).

If you are ok with this, I may suggest a patch.

Regards,
Louis