Tracking upstream projects that do not support hermetic-usr for configuration #76

bluca · 2023-09-16T14:40:18Z

This issue will be used to track Linux projects that do not currently support hermetic-usr configuration style (ie: /usr/lib/foo as default, /run/foo as ephemeral local override, /etc/foo as persistent local override). The purpose is to have a cross-distribution list of items to slowly work through, to be able to have a bootable and working minimal Linux image-based system with only /usr.

This list is not definitive and will get updated as we go.

The text was updated successfully, but these errors were encountered:

thkukuk · 2023-09-19T10:58:11Z

A first bunch, starting with a minimal OS running containers.

update-alternatives (from dpkg) uses /etc/alternatives. There is https://github.com/openSUSE/libalternatives but this only works for binaries, not e.g. manual pages
selinux-policy installs the policy in /etc/selinux/ and /var/lib/selinux/. Especially the last is a problem, as this mixes user changes with policy defaults. /var/lib/selinux needs to be splitted: the package defaults belongs somewhere to /usr, which should be merged with the admin changes (should be stored in /etc/, not /var) at runtime.
sudo has /etc/sudo.conf, /etc/sudoers and /etc/sudo_logsrvd.conf
audit (/etc/audit/auditd.conf, /etc/libaudit.conf)
rsync (/etc/rsyncd.conf)
chrony (/etc/chrony.conf)
podman and releated tools/libraries (/etc/containers)

julian-klode · 2023-09-19T11:05:36Z

APT and dpkg both don't support it. I haven't figured out the behavior for APT yet, tbh, it's weird because essentially everything is drop-ins for apt.conf these days.

thkukuk · 2023-09-19T13:56:55Z

glibc for /etc/services (used by getservbyname/getservbyport, which make little sense and are not widely used, but there still are some applications which do). It should be moved under /usr.

getservbyname/getservbyport are using NSS as backend. There are NSS modules for nearly every location, not only /etc/services, NIS or LDAP, but also for /usr. There is e.g. https://github.com/openSUSE/libnss_usrfiles, which, with the /etc/nsswitch.conf option services: files usrfiles looks at first for entries in /etc/services and afterwards in /usr/etc/services. More such modules exists, so in my opinion, this task is solved, it's just in the responsibility of the Linux distributior to package the best fitting variant and configure it. openSUSE Tumbleweed/MicroOS are doing this since many years.
So this is solved for aliases, ethers, protocols, rpc and services.
/etc/shells is not handled by NSS, so solving that will be more complicated.

fbuihuu · 2023-09-20T08:37:43Z

I dare to add to the list :

systemd ships all its main config files in /etc/systemd or /etc/udev.

There's currently systemd/systemd#28919 to address this issue by giving the possibility to downstream to ship the config files in /usr/lib but for some reasons the idea has not been well received.

poettering · 2023-09-20T15:46:42Z

@fbuihuu systemd's config files in /etc/ are just decoration. Entirely redundant, they are pretty much just helpful hints to people who want to sue traditional populated /etc/. If you delete them for modern systems that come up without /etc/ then behaviour is not changed whatsoever.

All options listed in them just give users hints on the available settings and their defaults, and those options are fully commented, hence these files are NOPs.

thkukuk · 2023-09-26T17:22:09Z

Next package list:

glibc:
- /etc/nsswitch.conf (https://bugzilla.suse.com/show_bug.cgi?id=1215487)
- /etc/host.conf
- /etc/rpc
- ldconfig (/etc/ld.so.conf, /etc/ld.so.conf.d, but no /usr/...)
mailx (/etc/mail.rc)
util-linux (/etc/blkid.conf)
fcoe-utils (/etc/fcoe/)
SELinux
- policycoreutils/sestatus (/etc/sestatus.conf)
open-iscsi (/etc/iscsi/iscsid.conf)
krb5 (/etc/krb5.conf)
libnl (/etc/libnl/)
libssh (/etc/libssh/)
e2fsprogs (/etc/mke2fs.conf)
nftables (/etc/nftables/)
smartmontools (/etc/smartd.conf, /etc/smartd_warning.sh)
wpa_supplicant (/etc/wpa_supplicant/wpa_supplicant.conf)
attr (/etc/xattr.conf)
zypper (/etc/zypp/zypp.conf, /etc/zypp/zypper.conf)

thkukuk · 2023-09-27T07:06:40Z

For glibc I missed yesterday:

nscd (/etc/nscd.conf)

This are now all packages from our minimal installation of MicroOS as ContainerHost beside openssh.
I spoke already with the openssh developers about this some time ago, they rejected all ideas to modify configuration file handling. So we (openSUSE) reconfigured the configuration file setup to mimic hermetic-usr as far as possible, open issue is AcceptEnv, which you cannot overwrite.

Question is how far do we want to go with that list? I could go as next through a typical server installation and desktop system, but I don't know if this would be really helpful, as the list is already long and it would mix up packages with different priority.

bluca · 2023-09-27T09:29:05Z

This are now all packages from our minimal installation of MicroOS as ContainerHost beside openssh. I spoke already with the openssh developers about this some time ago, they rejected all ideas to modify configuration file handling. So we (openSUSE) reconfigured the configuration file setup to mimic hermetic-usr as far as possible, open issue is AcceptEnv, which you cannot overwrite.

Yeah I had the same experience some years past, openssh as a project is just not interested in anything that doesn't directly benefit BSD. Should we set up a Linux-focused fork, where we can co-maintain patches?

Question is how far do we want to go with that list? I could go as next through a typical server installation and desktop system, but I don't know if this would be really helpful, as the list is already long and it would mix up packages with different priority.

I think this is a good starting point, being core packages they are the highest value to fix. Once we have made a dent in the current list, then we could start looking at a server installation.

keszybz · 2023-10-04T14:00:05Z

nscd (/etc/nscd.conf)

nscd is on its way out: https://fedoraproject.org/wiki/Changes/RemoveNSCD.
IIRC, the intent was to also propose the same from glibc upstream if the experiment in Fedora is successful.

ReillyBrogan · 2023-11-13T04:05:21Z

Apparmor is another one that doesn't support any kind of vendordir at the moment.

schubi2 · 2023-12-04T13:57:34Z

/etc/rsyncd.conf should be solved with:
RsyncProject/rsync#551

util-linux (/etc/blkid.conf):
util-linux/util-linux#2616

schubi2 · 2023-12-06T12:15:48Z

I have fixed mailx (/etc/mail.rc) in SUSE OBS: https://build.opensuse.org/request/show/1131341
I would like to do it upstream too, but I do not find the code stream to which I can make a PR.
Does anyone know where mailx is hosted upstream ?
I know, it is really old code :-)

bluca · 2023-12-06T12:20:53Z

In Debian we ship bsd-mailx: https://tracker.debian.org/pkg/bsd-mailx which according to package metadata comes from https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/mail/

schubi2 · 2023-12-06T15:47:13Z

In Debian we ship bsd-mailx: https://tracker.debian.org/pkg/bsd-mailx which according to package metadata comes from https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/mail/

Thanks for hint ! I have sent a patch to [email protected] .

poettering · 2023-12-07T09:10:22Z

I filed this bug against Fedora's authselect now:

authselect/authselect#355

schubi2 · 2023-12-13T15:20:37Z

I have made a PR for fcoe-utils:
openSUSE/fcoe-utils#24

schubi2 · 2023-12-15T12:30:44Z

I have submitted a patch for selinux:
SELinuxProject/selinux#415

Conan-Kudo · 2023-12-17T12:41:12Z

DNF 5 supports hermetic configuration since 5.1.4.

rpm-software-management/dnf5#813
rpm-software-management/dnf5#820
rpm-software-management/dnf5#882

keszybz · 2023-12-17T15:15:43Z

rpm-software-management/dnf5#813
rpm-software-management/dnf5#820
rpm-software-management/dnf5#882

Thanks. I filed rpm-software-management/dnf5#1107.

DaanDeMeyer · 2023-12-21T13:56:34Z

What about ca-certificates? That one seems to be prominently missing from the list? Debian already seems to put certificates in /usr/share/ca-certificates, whereas Fedora uses /etc/pki and OpenSUSE /var/lib/ca-certificates? It'd be great if we could standardize on /usr/share/ca-certificates in some form (not familiar with the details)

schubi2 · 2023-12-29T16:59:34Z

I have submitted a patch for open-iscsi:
open-iscsi/open-iscsi#437

Conan-Kudo · 2023-12-29T17:05:16Z

What about ca-certificates? That one seems to be prominently missing from the list? Debian already seems to put certificates in /usr/share/ca-certificates, whereas Fedora uses /etc/pki and OpenSUSE /var/lib/ca-certificates? It'd be great if we could standardize on /usr/share/ca-certificates in some form (not familiar with the details)

A /usr/share/pki hierarchy as an equivalent to the one in /etc/pki would allow moving most of this stuff.

DaanDeMeyer · 2024-02-09T10:37:59Z

Another one that seems to be missing is openssl

This comment was marked as outdated.

Sign in to view

keszybz mentioned this issue Sep 21, 2023

meson: introduce a build option for customizing the install paths of … systemd/systemd#29244

Merged

thkukuk mentioned this issue Oct 14, 2023

Add /etc/security/pam_env.conf.d/ linux-pam/linux-pam#613

Closed

thkukuk mentioned this issue Nov 22, 2023

pam_shells: Use the vendor directory as fallback for a distribution provided default config if there is no one in /etc. linux-pam/linux-pam#509

Merged

poettering mentioned this issue Dec 7, 2023

Automatically run authselect on first boot authselect/authselect#355

Open

DaanDeMeyer mentioned this issue Feb 23, 2024

Look for config in /usr as well rpm-software-management/rpm-sequoia#65

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Tracking upstream projects that do not support hermetic-usr for configuration #76

Tracking upstream projects that do not support hermetic-usr for configuration #76

bluca commented Sep 16, 2023 •

edited by DaanDeMeyer

thkukuk commented Sep 19, 2023

julian-klode commented Sep 19, 2023

thkukuk commented Sep 19, 2023

fbuihuu commented Sep 20, 2023 •

edited by jepio

This comment was marked as outdated.

poettering commented Sep 20, 2023

thkukuk commented Sep 26, 2023

thkukuk commented Sep 27, 2023

bluca commented Sep 27, 2023

keszybz commented Oct 4, 2023 •

edited

ReillyBrogan commented Nov 13, 2023

schubi2 commented Dec 4, 2023

schubi2 commented Dec 6, 2023

bluca commented Dec 6, 2023

schubi2 commented Dec 6, 2023

poettering commented Dec 7, 2023

schubi2 commented Dec 13, 2023

schubi2 commented Dec 15, 2023

Conan-Kudo commented Dec 17, 2023

keszybz commented Dec 17, 2023

DaanDeMeyer commented Dec 21, 2023

schubi2 commented Dec 29, 2023

Conan-Kudo commented Dec 29, 2023

DaanDeMeyer commented Feb 9, 2024

Tracking upstream projects that do not support hermetic-usr for configuration #76

Tracking upstream projects that do not support hermetic-usr for configuration #76

Comments

bluca commented Sep 16, 2023 • edited by DaanDeMeyer

thkukuk commented Sep 19, 2023

julian-klode commented Sep 19, 2023

thkukuk commented Sep 19, 2023

fbuihuu commented Sep 20, 2023 • edited by jepio

This comment was marked as outdated.

poettering commented Sep 20, 2023

thkukuk commented Sep 26, 2023

thkukuk commented Sep 27, 2023

bluca commented Sep 27, 2023

keszybz commented Oct 4, 2023 • edited

ReillyBrogan commented Nov 13, 2023

schubi2 commented Dec 4, 2023

schubi2 commented Dec 6, 2023

bluca commented Dec 6, 2023

schubi2 commented Dec 6, 2023

poettering commented Dec 7, 2023

schubi2 commented Dec 13, 2023

schubi2 commented Dec 15, 2023

Conan-Kudo commented Dec 17, 2023

keszybz commented Dec 17, 2023

DaanDeMeyer commented Dec 21, 2023

schubi2 commented Dec 29, 2023

Conan-Kudo commented Dec 29, 2023

DaanDeMeyer commented Feb 9, 2024

bluca commented Sep 16, 2023 •

edited by DaanDeMeyer

fbuihuu commented Sep 20, 2023 •

edited by jepio

keszybz commented Oct 4, 2023 •

edited