This is the mail archive of the
libc-alpha@sourceware.org
mailing list for the glibc project.
Re: [PATCH] Move nss_compat from nis to nss subdir and install it unconditionally.
- From: Carlos O'Donell <carlos at redhat dot com>
- To: Zack Weinberg <zackw at panix dot com>, Andreas Schwab <schwab at suse dot de>, DJ Delorie <dj at redhat dot com>
- Cc: Florian Weimer <fweimer at redhat dot com>, Yury Norov <ynorov at caviumnetworks dot com>, GNU C Library <libc-alpha at sourceware dot org>, Steve dot Ellcey at cavium dot com, Maxim Kuvyrkov <maxim dot kuvyrkov at linaro dot org>
- Date: Wed, 4 Oct 2017 20:32:46 -0700
- Subject: Re: [PATCH] Move nss_compat from nis to nss subdir and install it unconditionally.
- Authentication-results: sourceware.org; auth=none
- References: <20170927215018.6nagohfthyezs3mo@yury-thinkpad> <de59bd81-d555-b9dc-5089-2926b5a2573a@redhat.com> <20170928112847.i2hnrzr2zm66z2un@yury-thinkpad> <017aeba9-6400-6ef2-b70c-74db69b1aa39@redhat.com> <20170928122836.3srxfgn5vh5utngs@yury-thinkpad> <b4b07d46-0792-c36c-b369-69f6c5055b19@redhat.com> <CAKCAbMhvSc9D1VrXw5GTioU-s0QypA8S3KjRRcCp+hkE4BGPPg@mail.gmail.com> <b8613b22-6d6f-3f08-24af-cc2dfa5373b9@redhat.com> <CAKCAbMgTPcy9E6GRni-pzYhjMLd5h8+y2mUQVK7UyCbXkAgh1g@mail.gmail.com> <mvmo9pn5jhp.fsf_-_@suse.de> <CAKCAbMhTNABAkfc2jeq1GpL7_FmcGGuG2o81gDe5_Lct4e8MZg@mail.gmail.com>
On 10/04/2017 07:35 AM, Zack Weinberg wrote:
> On Wed, Oct 4, 2017 at 5:51 AM, Andreas Schwab <schwab@suse.de> wrote:
>> This has been tested that local lookup still works with and
>> without an installed libnss_nis, and that NIS lookup works when
>> libnss_nis is available.
>
> It now occurs to me that another test might be a good idea: configure
> a system with at least one local non-root user and also at least one
> +user or +@netgroup line in /etc/passwd, and "passwd: compat" in
> /etc/nsswitch.conf, but *don't* install libnss_nis or any NIS
> configuration; then make sure that all of the local users can log in
> even though libnss_nis is unavailable (that is, _compat only tries to
> use _nis if it doesn't find a local match for the query), that the
> users included from NIS *cannot* log in (fail closed), and that the
> failure to log in produces an error message that will point the
> sysadmin at least vaguely in the right direction.
I would also like to see more testing of this kind, and in fact
DJ is looking into this kind of more complicated testing within
upstream glibc's test framework and expanding it as required.
Right now we just don't have the framework pieces in place though
which is why we all manually test NSS stuff.
--
Cheers,
Carlos.