User accounts

[ludo@gnu.org (Ludovic Courtès)]

Before commit ab6a279, /etc/{group,passwd,shadow} were all created from
a derivation.  Thus, /etc contained symlinks to those files, which were
actually in the store.  Being in the store, they were all immutable and
world-readable (you can see that in the VM image released with 0.6.)

That was obviously not desirable, because then everyone can read shadow,
and because that prevents passwords from being changed.

So commit ab6a279 changed accounts to be created at “activation
time”—i.e., when booting, or when switching to a new operating system
configuration.  What happens is that the activation code checks for all
the user accounts and groups required by the ‘operating-system’
declaration, and invokes ‘useradd’ and ‘groupadd’ for any missing
account/group.

That way, {group,passwd,shadow} are normal state files with the right
permissions, and everything works as expected.  NixOS uses the same
strategy.

Ludo’.