From: Edouard Klein <edou@rdklein.fr>
To: "Ludovic Courtès" <ludo@gnu.org>
Cc: 43371@debbugs.gnu.org, conjaroy <conjaroy@gmail.com>,
41575@debbugs.gnu.org
Subject: [bug#43371] [PATCH] doc: prevent host/container nscd mismatch
Date: Mon, 14 Sep 2020 09:24:32 +0200 [thread overview]
Message-ID: <87tuw0ddn3.fsf@rdklein.fr> (raw)
In-Reply-To: <87y2ld9ym2.fsf@gnu.org>
Hi !
Ludovic Courtès writes:
> Hi,
>
> edk@beaver-labs.com skribis:
>
>> doc/guix.texi: (Name Service Switch) add a workaround for bug #41575
>> ---
>> doc/guix.texi | 16 +++++++++++++++-
>> 1 file changed, 15 insertions(+), 1 deletion(-)
>>
>> diff --git a/doc/guix.texi b/doc/guix.texi
>> index a6e14ea177..a9472e680e 100644
>> --- a/doc/guix.texi
>> +++ b/doc/guix.texi
>> @@ -1706,6 +1706,20 @@ this binary incompatibility problem because those @code{libnss_*.so}
>> files are loaded in the @command{nscd} process, not in applications
>> themselves.
>>
>> +For applications running in containers (@pxref{Invokin guix container}),
>> +however, @code{nscd} may leak information from the host to the container.
>> +If there is a configuration mismatch between the two ---e.g., the host
>> +has no @code{sshd} user while the container needs one--- then it may be
>
> I find the example is hard to understand. How about: “applications in
> the container could end up looking users in the host”?
>
>> +worthwhile to limit which kind of information the host's @code{nscd}
>> +daemon may give to the container by adding the following to
>> +@code{/etc/nscd.conf}.
>> +
>> +@example
>> + enable-cache passwd no
>> + enable-cache group no
>> + enable-cache netgroup no
>> +@end example
>
> Actually, perhaps the better fix is to never use the host’s nscd? We
> could change ‘containerized-operating-system’ accordingly.
>
I think this would be best, but I did not know where to make this
change, so I just edited the doc instead. I don't know if containers
need the host's nscd to avoid the libc issues mentionned in the doc, but
if they dont, then prevening them from accessing the host's nscd seems
logical and would solve the problem. And we wouldn't need to amend the
doc at all.
> That would allow guest OSes to work correctly regardless of the host’s
> nscd config, which seems like an improvement.
>
> Thoughts?
>
> Ludo’.
next prev parent reply other threads:[~2020-09-14 7:25 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-13 10:30 [bug#43371] [PATCH] doc: prevent host/container nscd mismatch edk
2020-09-13 21:05 ` Ludovic Courtès
2020-09-14 1:05 ` bug#41575: " conjaroy
2020-09-14 1:05 ` conjaroy
2020-09-14 7:26 ` bug#41575: " Ludovic Courtès
2020-09-14 22:53 ` [bug#43371] " conjaroy
2020-09-14 7:24 ` Edouard Klein [this message]
2020-10-05 8:36 ` Ludovic Courtès
2020-10-05 17:01 ` Edouard Klein
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87tuw0ddn3.fsf@rdklein.fr \
--to=edou@rdklein.fr \
--cc=41575@debbugs.gnu.org \
--cc=43371@debbugs.gnu.org \
--cc=conjaroy@gmail.com \
--cc=ludo@gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this external index
https://git.savannah.gnu.org/cgit/guix.git
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.