From: "Ludovic Courtès" <ludo@gnu.org>
To: edk@beaver-labs.com
Cc: 43371@debbugs.gnu.org, conjaroy <conjaroy@gmail.com>,
41575@debbugs.gnu.org
Subject: [bug#43371] [PATCH] doc: prevent host/container nscd mismatch
Date: Sun, 13 Sep 2020 23:05:09 +0200 [thread overview]
Message-ID: <87y2ld9ym2.fsf@gnu.org> (raw)
In-Reply-To: <87lfhet1d2.fsf@rdklein.fr> (edk@beaver-labs.com's message of "Sun, 13 Sep 2020 12:30:49 +0200")
Hi,
edk@beaver-labs.com skribis:
> doc/guix.texi: (Name Service Switch) add a workaround for bug #41575
> ---
> doc/guix.texi | 16 +++++++++++++++-
> 1 file changed, 15 insertions(+), 1 deletion(-)
>
> diff --git a/doc/guix.texi b/doc/guix.texi
> index a6e14ea177..a9472e680e 100644
> --- a/doc/guix.texi
> +++ b/doc/guix.texi
> @@ -1706,6 +1706,20 @@ this binary incompatibility problem because those @code{libnss_*.so}
> files are loaded in the @command{nscd} process, not in applications
> themselves.
>
> +For applications running in containers (@pxref{Invokin guix container}),
> +however, @code{nscd} may leak information from the host to the container.
> +If there is a configuration mismatch between the two ---e.g., the host
> +has no @code{sshd} user while the container needs one--- then it may be
I find the example is hard to understand. How about: “applications in
the container could end up looking users in the host”?
> +worthwhile to limit which kind of information the host's @code{nscd}
> +daemon may give to the container by adding the following to
> +@code{/etc/nscd.conf}.
> +
> +@example
> + enable-cache passwd no
> + enable-cache group no
> + enable-cache netgroup no
> +@end example
Actually, perhaps the better fix is to never use the host’s nscd? We
could change ‘containerized-operating-system’ accordingly.
That would allow guest OSes to work correctly regardless of the host’s
nscd config, which seems like an improvement.
Thoughts?
Ludo’.
next prev parent reply other threads:[~2020-09-13 21:06 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-13 10:30 [bug#43371] [PATCH] doc: prevent host/container nscd mismatch edk
2020-09-13 21:05 ` Ludovic Courtès [this message]
2020-09-14 1:05 ` conjaroy
[not found] ` <87pn6oq0nc.fsf@gnu.org>
2020-09-14 22:53 ` [bug#43371] bug#41575: " conjaroy
2020-09-14 7:24 ` Edouard Klein
[not found] ` <87h7r93w96.fsf@gnu.org>
2020-10-05 17:01 ` Edouard Klein
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87y2ld9ym2.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=41575@debbugs.gnu.org \
--cc=43371@debbugs.gnu.org \
--cc=conjaroy@gmail.com \
--cc=edk@beaver-labs.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).