unofficial mirror of guix-patches@gnu.org 
 help / color / mirror / code / Atom feed
From: "Ludovic Courtès" <ludo@gnu.org>
To: edk@beaver-labs.com
Cc: 43371@debbugs.gnu.org, conjaroy <conjaroy@gmail.com>,
	41575@debbugs.gnu.org
Subject: [bug#43371] [PATCH] doc: prevent host/container nscd mismatch
Date: Sun, 13 Sep 2020 23:05:09 +0200	[thread overview]
Message-ID: <87y2ld9ym2.fsf@gnu.org> (raw)
In-Reply-To: <87lfhet1d2.fsf@rdklein.fr> (edk@beaver-labs.com's message of "Sun, 13 Sep 2020 12:30:49 +0200")

Hi,

edk@beaver-labs.com skribis:

> doc/guix.texi: (Name Service Switch) add a workaround for bug #41575
> ---
>  doc/guix.texi | 16 +++++++++++++++-
>  1 file changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/doc/guix.texi b/doc/guix.texi
> index a6e14ea177..a9472e680e 100644
> --- a/doc/guix.texi
> +++ b/doc/guix.texi
> @@ -1706,6 +1706,20 @@ this binary incompatibility problem because those @code{libnss_*.so}
>  files are loaded in the @command{nscd} process, not in applications
>  themselves.
>  
> +For applications running in containers (@pxref{Invokin guix container}),
> +however, @code{nscd} may leak information from the host to the container.
> +If there is a configuration mismatch between the two ---e.g., the host
> +has no @code{sshd} user while the container needs one--- then it may be

I find the example is hard to understand.  How about: “applications in
the container could end up looking users in the host”?

> +worthwhile to limit which kind of information the host's @code{nscd}
> +daemon may give to the container by adding the following to
> +@code{/etc/nscd.conf}.
> +
> +@example
> +        enable-cache            passwd          no
> +        enable-cache            group           no
> +        enable-cache            netgroup        no
> +@end example

Actually, perhaps the better fix is to never use the host’s nscd?  We
could change ‘containerized-operating-system’ accordingly.

That would allow guest OSes to work correctly regardless of the host’s
nscd config, which seems like an improvement.

Thoughts?

Ludo’.




  reply	other threads:[~2020-09-13 21:06 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-13 10:30 [bug#43371] [PATCH] doc: prevent host/container nscd mismatch edk
2020-09-13 21:05 ` Ludovic Courtès [this message]
2020-09-14  1:05   ` conjaroy
     [not found]     ` <87pn6oq0nc.fsf@gnu.org>
2020-09-14 22:53       ` [bug#43371] bug#41575: " conjaroy
2020-09-14  7:24   ` Edouard Klein
     [not found]     ` <87h7r93w96.fsf@gnu.org>
2020-10-05 17:01       ` Edouard Klein

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

  List information: https://guix.gnu.org/

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87y2ld9ym2.fsf@gnu.org \
    --to=ludo@gnu.org \
    --cc=41575@debbugs.gnu.org \
    --cc=43371@debbugs.gnu.org \
    --cc=conjaroy@gmail.com \
    --cc=edk@beaver-labs.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).