/etc/passwd thoughts

[warren@newcaprica dracut]$ grep -r \/etc\/passwd * modules.d/95nfs/install:dracut_install /etc/netconfig /etc/passwd /etc/services
modules.d/95nfs/install:#echo "rpc:x:32:32:Rpcbind:/var/lib/rpcbind:/bin/false" >> "$initdir/etc/passwd"
modules.d/90mdraid/install:inst /etc/passwd

It seems that we want an /etc/passwd for certain things in the initrd image, but is it really necessary for it to copy whatever users are on the generating system into the image?

Quoted 8 lines · Warren Togami

[warren@newcaprica dracut]$ grep -r \/etc\/passwd * modules.d/95nfs/install:dracut_install /etc/netconfig /etc/passwd /etc/services
modules.d/95nfs/install:#echo "rpc:x:32:32:Rpcbind:/var/lib/rpcbind:/bin/false">> "$initdir/etc/passwd"
modules.d/90mdraid/install:inst /etc/passwd

Quoted 3 lines

It seems that we want an /etc/passwd for certain things in the initrd image, but is it really necessary for it to copy whatever users are on the generating system into the image?

If daemons we want/need to start want to drop privleges... yes.

Quoted 13 lines · Bill Nottingham

Quoted 11 lines · Warren Togami

[warren@newcaprica dracut]$ grep -r \/etc\/passwd * modules.d/95nfs/install:dracut_install /etc/netconfig /etc/passwd /etc/services
modules.d/95nfs/install:#echo "rpc:x:32:32:Rpcbind:/var/lib/rpcbind:/bin/false">> "$initdir/etc/passwd"
modules.d/90mdraid/install:inst /etc/passwd

It seems that we want an /etc/passwd for certain things in the initrd image, but is it really necessary for it to copy whatever users are on the generating system into the image?

Quoted 2 lines

If daemons we want/need to start want to drop privleges... yes.

But it is also pulling in user accounts.

It seems the above modules.d/95nfs/install creates its own /etc/passwd entry that it expects to be there. Why can't we do this for all cases where something in the initrd needs an /etc/passwd entry?

Actually 95nfs doesn't create its own entry. The part is commented out.

But I agree we should do something about the passwd case.

Question: Who really needs passwd entries?

Quoted 1 line · Seewer Philippe

Actually 95nfs doesn't create its own entry. The part is commented out.

Right; I'm torn on this. We want to support both portmap and rpcbind, and at least rpcbind needs a user to run as -- it won't run without it. I don't know what portmap wants.

Quoted 1 line · Seewer Philippe

Actually 95nfs doesn't create its own entry. The part is commented out.

Right; I'm torn on this. We want to support both portmap and rpcbind, and at least rpcbind needs a user to run as -- it won't run without it. I don't know what portmap wants.

I have it copying the passwd file as that seemed to be the most distro-agnostic way I could do it.

I see a few options --
1) Copy /etc/passwd from the distro into the initrd; exposes user names, but passwords should be in /etc/shadow and hence not copied.
2) Make our own users for rpcbind (and portmap if different) and just use that. rpcbind gets killed before we transition to root, so the uid doesn't have to match up.

Quoted 4 lines

If rpcbind, then write only the necessary user into the initrd's /etc/passwd. Do not copy the generating system's /etc/passwd.

Any objections?

s.th. like

grep $user /etc/passwd >> ${initdir}/etc/passwd

?

Quoted 7 lines · Harald Hoyer

Quoted 4 lines

If rpcbind, then write only the necessary user into the initrd's /etc/passwd. Do not copy the generating system's /etc/passwd.

Any objections?

s.th. like

Quoted 3 lines

grep $user /etc/passwd >> ${initdir}/etc/passwd

?

Yes, except does the rpcbind user need to run as any userid number in particular? rpcbind gets killed before switch_root right? We might be able to do this without grep scraping.