F45 Change Proposal: Authselect: Hardcode nss-altfiles in profiles (self-contained)

Wiki - https://fedoraproject.org/wiki/Changes/Authselect_Hardcode_Altfiles Discussion thread - https://discussion.fedoraproject.org/t/f45-change-proposal-authselect-hardcode-nss-altfiles-in-profiles-self-contained/197236 This is a proposed Change for Fedora Linux. This document represents a proposed Change. As part of the Changes process, proposals are publicly announced in order to receive community feedback. This proposal will only be implemented if approved by the Fedora Engineering Steering Committee. == Summary == Currently, authselect users can enable nss-altfiles in nsswitch.conf using "with-altfiles" feature. This proposal is to remove the feature and hardcode nss-altfiles support in nsswitch.conf in all shipped profiles, making it required. == Owner == * Name: [[User:pbrezina| Pavel Březina]] * Email: pbrezina@redhat.com == Detailed Description == Currently, non-ostree systems (e.g. Fedora Workstation) have nss-altfiles nsswitch.conf module optional in authselect profiles. Users can enable this module by calling "authselect enable-feature with-altfiles" or directly when selecting the profile "authselect select $profile with-altfiles". However, the nss-altfiles nsswitch.conf module is required to be enabled on ostree systems (e.g. Fedora Silverblue) and must not be disabled there to make system users available to the system. This is currently handled by authselect in %post scriptlet that modifies the shipped profiles and hardcodes nss-altfiles in them. This solution, however, makes authselect different on ostree and non-ostree systems. The history also showed that it is quite fragile and easy to break with modifications to the profiles. The intention is to hardcode nss-altfiles on both ostree and non-ostree, making authselect install exactly the same files on both distribution types. == Feedback == None. == Benefit to Fedora == Both ostree and non-ostree Fedora releases will ship exactly the same authselect content. == Scope == * Proposal owners: Do the work in upstream and release it in Fedora. * Other developers: None. * Release engineering: None. [https://forge.fedoraproject.org/releng/tickets/issues #Releng issue number] * Policies and guidelines: N/A (not needed for this Change) * Trademark approval: N/A (not needed for this Change) * Alignment with the Fedora Strategy: == Upgrade/compatibility impact == None. Upgrade path will be handled by authselect. == Early Testing (Optional) == == How To Test == 1. Check that with-altfiles is no longer available in the profiles 2. Check that "altfiles" is present in generated /etc/nsswitch.conf == User Experience == User's should not notice the change. == Dependencies == None. == Contingency Plan == * Contingency mechanism: N/A (not a System Wide Change) * Contingency deadline: N/A (not a System Wide Change) * Blocks release? N/A (not a System Wide Change) == Documentation == N/A (not a System Wide Change) == Release Notes == The "with-altfiles" feature has been removed from all authselect profiles. The nss-altfiles support is now enabled and can not be disabled. -- Aoife Moloney Fedora Operations Architect Fedora Project Matrix: @amoloney:fedora.im IRC: amoloney -- _______________________________________________ devel-announce mailing list -- devel-announce@lists.fedoraproject.org To unsubscribe send an email to devel-announce-leave@lists.fedoraproject.org Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel-announce@lists.fedoraproject.org Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new