From: "Ludovic Courtès" <ludo@gnu.org>
To: Mark H Weaver <mhw@netris.org>
Cc: Brendan Tildesley <btild@mailbox.org>, 36508@debbugs.gnu.org
Subject: bug#36508: GDM files have incorrect owner after temporarily removing service
Date: Fri, 16 Apr 2021 17:18:06 +0200 [thread overview]
Message-ID: <87tuo645sh.fsf@gnu.org> (raw)
In-Reply-To: <87zgxzgpbf.fsf@netris.org> (Mark H. Weaver's message of "Thu, 15 Apr 2021 18:22:49 -0400")
Hi,
Mark H Weaver <mhw@netris.org> skribis:
> It's true that if you delete a user or group on another distro and then
> re-add it, it might not be assigned the same UID/GID. That much is the
> same as any other distro.
>
> The key difference is this: On Debian, at least in my experience, users
> and groups are *never* deleted automatically. They are only added
> automatically, but never removed unless you explicitly ask to remove
> them. So, this problem does not arise in practice.
>> Maintain historical mappings from user/group names to UIDs/GIDs, perhaps
>> in some file in /etc, where entries are added but *never* automatically
>> removed. When allocating UIDs/GIDs, we would avoid any UIDs/GIDs in the
>> range of those mappings.
If we’re just worried about ID allocation, we could keep state in, say,
/etc/previous-uids, and feed that as input to the (gnu build accounts)
allocation code.
Thoughts?
Maxime Devos <maximedevos@telenet.be> skribis:
> This seems rather convoluted to me. Why not reuse /etc/passwd and /etc/groups?
> My suggestion:
>
> 1. *never* automatically delete users/groups from /etc/passwd, /etc/groups
> (I thought that was how Guix already worked ...)
> 2. as users and groups appearing in /etc/passwd and /etc/groups, but not
> in the operating system configuration can be confusing, change the comment
> string of these users and groups, to something like
>
> "account removed"
>
> Add a group 'user-graveyard' for (3), and move these 'pseudo-removed' users
> to the 'user-graveyard' group.
> 3. Don't forget to remove graveyard users from all groups (except user-graveyard),
> make sure the graveyard users can't log in anymore ... (Perhaps add a rule to
> the SSH and PAM configuration that forbids logging in to graveyard accounts,
> by checking whether the user is in the 'user-graveyard' group?)
Problem is that things like GDM would still propose those old accounts
(unless maybe their password is uninitialized, I’m not sure; but it’s
still hacky.)
Thanks,
Ludo’.
next prev parent reply other threads:[~2021-04-16 15:19 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-05 8:36 bug#36508: GDM files have incorrect owner after temporarily replacing with SDDM ison
2021-04-13 13:24 ` bug#36508: GDM files have incorrect owner after temporarily removing service Brendan Tildesley via Bug reports for GNU Guix
2021-04-13 20:51 ` Mark H Weaver
2021-04-14 4:31 ` Brendan Tildesley via Bug reports for GNU Guix
2021-04-15 18:09 ` Mark H Weaver
2021-04-14 10:32 ` Ludovic Courtès
2021-04-14 12:21 ` Brendan Tildesley via Bug reports for GNU Guix
2021-04-15 14:24 ` Ludovic Courtès
2021-04-15 18:30 ` Mark H Weaver
2021-04-15 20:05 ` Ludovic Courtès
2021-04-15 22:22 ` Mark H Weaver
2021-04-16 15:18 ` Ludovic Courtès [this message]
2021-04-17 16:16 ` Mark H Weaver
2021-04-15 23:04 ` Mark H Weaver
2021-04-16 15:14 ` Ludovic Courtès
2021-04-15 18:35 ` Mark H Weaver
2021-04-15 18:58 ` Mark H Weaver
2021-04-16 10:42 ` Maxime Devos
2021-04-17 16:28 ` Mark H Weaver
2022-09-18 12:22 ` bug#36508: [DRAFT PATCH] Stable allocation of uids, by keeping a historical mapping Maxime Devos
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87tuo645sh.fsf@gnu.org \
--to=ludo@gnu.org \
--cc=36508@debbugs.gnu.org \
--cc=btild@mailbox.org \
--cc=mhw@netris.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.