nixpkgs/nixos
Jamey Sharp f7c776760b nixos/nscd: only drop privs after nss module init
NixOS usually needs nscd just to have a single place where
LD_LIBRARY_PATH can be set to include all NSS modules, but nscd is also
useful if some of the NSS modules need to read files which are only
accessible by root.

For example, nixos/modules/config/ldap.nix needs this when
  users.ldap.enable = true;
  users.ldap.daemon.enable = false;
and users.ldap.bind.passwordFile exists. In that case, the module
creates an /etc/ldap.conf which is only readable by root, but which the
NSS module needs to read in order to find out what LDAP server to
connect to and with what credentials.

If nscd is started as root and configured with the server-user option in
nscd.conf, then it gives each NSS module the opportunity to initialize
itself before dropping privileges. The initialization happens in the
glibc-internal __nss_disable_nscd function, which pre-loads all the
configured NSS modules for passwd, group, hosts, and services (but not
netgroup for some reason?) and, for each loaded module, calls an init
function if one is defined. After that finishes, nscd's main() calls
nscd_init() which ends by calling finish_drop_privileges().

There are provisions in systemd for using DynamicUser with a service
which needs to drop privileges itself, so this patch does that.
2019-07-07 08:43:41 -07:00
..
doc Add missing semicolon (#63919) 2019-06-29 15:52:21 +00:00
lib make-ext4-fs: Allows populating with custom files 2019-06-16 17:47:30 -04:00
maintainers treewide: Remove usage of isNull 2019-04-29 14:05:50 +02:00
modules nixos/nscd: only drop privs after nss module init 2019-07-07 08:43:41 -07:00
tests fix mysql test after #63862 introduced non-functional initialScript 2019-07-03 00:35:35 +02:00
COPYING
default.nix
README
release-combined.nix nixos/release: make ipv6 tests as important as legacy IP tests 2019-03-24 18:09:39 +01:00
release-small.nix nixos/release: make ipv6 tests as important as legacy IP tests 2019-03-24 18:09:39 +01:00
release.nix nixos/sd-image-aarch64-new-kernel: Added to release 2018-12-26 11:03:32 +00:00

*** NixOS ***

NixOS is a Linux distribution based on the purely functional package
management system Nix.  More information can be found at
http://nixos.org/nixos and in the manual in doc/manual.