shaba/systemd-stable
1
1
Fork 0
mirror of https://github.com/systemd/systemd-stable.git synced 2025-01-03 01:17:45 +03:00
Code
798d7d0a8a
systemd-stable/sysusers.d/basic.conf.in

40 lines
1.2 KiB
Plaintext
Raw Normal View History

sysusers: add minimal tool to reconstruct /etc/passwd and /etc/group from static files systemd-sysusers is a tool to reconstruct /etc/passwd and /etc/group from static definition files that take a lot of inspiration from tmpfiles snippets. These snippets should carry information about system users only. To make sure it is not misused for normal users these snippets only allow configuring UID and gecos field for each user, but do not allow configuration of the home directory or shell, which is necessary for real login users. The purpose of this tool is to enable state-less systems that can populate /etc with the minimal files necessary, solely from static data in /usr. systemd-sysuser is additive only, and will never override existing users. This tool will create these files directly, and not via some user database abtsraction layer. This is appropriate as this tool is supposed to run really early at boot, and is only useful for creating system users, and system users cannot be stored in remote databases anyway. The tool is also useful to be invoked from RPM scriptlets, instead of useradd. This allows moving from imperative user descriptions in RPM to declarative descriptions. The UID/GID for a user/group to be created can either be chosen dynamic, or fixed, or be read from the owner of a file in the file system, in order to support reconstructing the correct IDs for files that shall be owned by them. This also adds a minimal user definition file, that should be sufficient for most basic systems. Distributions are expected to patch these files and augment the contents, for example with fixed UIDs for the users where that's necessary.
2014-06-13 00:54:02 +04:00
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
# The superuser
sysusers: set home directory for root to /root
2014-08-19 18:38:43 +04:00
u root 0 "Super User" /root
sysusers: add minimal tool to reconstruct /etc/passwd and /etc/group from static files systemd-sysusers is a tool to reconstruct /etc/passwd and /etc/group from static definition files that take a lot of inspiration from tmpfiles snippets. These snippets should carry information about system users only. To make sure it is not misused for normal users these snippets only allow configuring UID and gecos field for each user, but do not allow configuration of the home directory or shell, which is necessary for real login users. The purpose of this tool is to enable state-less systems that can populate /etc with the minimal files necessary, solely from static data in /usr. systemd-sysuser is additive only, and will never override existing users. This tool will create these files directly, and not via some user database abtsraction layer. This is appropriate as this tool is supposed to run really early at boot, and is only useful for creating system users, and system users cannot be stored in remote databases anyway. The tool is also useful to be invoked from RPM scriptlets, instead of useradd. This allows moving from imperative user descriptions in RPM to declarative descriptions. The UID/GID for a user/group to be created can either be chosen dynamic, or fixed, or be read from the owner of a file in the file system, in order to support reconstructing the correct IDs for files that shall be owned by them. This also adds a minimal user definition file, that should be sufficient for most basic systems. Distributions are expected to patch these files and augment the contents, for example with fixed UIDs for the users where that's necessary.
2014-06-13 00:54:02 +04:00
sysusers.d - fix typo in user definition file
2014-06-17 04:57:05 +04:00
# The nobody user for NFS file systems
meson: replace some m4 templates with jinja2 m4 was nice in '85, but the syntax feels a bit dated. Since we use python for meson, let's use a popular python templating engine to replace some m4 usage. A little nicety is that typos are caught: FAILED: sysusers.d/systemd-remote.conf /usr/bin/meson --internal exe --capture sysusers.d/systemd-remote.conf -- /home/zbyszek/src/systemd/tools/meson-render-jinja2.py config.h ../sysusers.d/systemd-remote.conf.j2 Traceback (most recent call last): File "/home/zbyszek/src/systemd/tools/meson-render-jinja2.py", line 28, in <module> print(render(sys.argv[2], defines)) File "/home/zbyszek/src/systemd/tools/meson-render-jinja2.py", line 24, in render return template.render(defines) File "/usr/lib/python3.9/site-packages/jinja2/environment.py", line 1090, in render self.environment.handle_exception() File "/usr/lib/python3.9/site-packages/jinja2/environment.py", line 832, in handle_exception reraise(*rewrite_traceback_stack(source=source)) File "/usr/lib/python3.9/site-packages/jinja2/_compat.py", line 28, in reraise raise value.with_traceback(tb) File "<template>", line 8, in top-level template code jinja2.exceptions.UndefinedError: 'HAVE_MICROHTTP' is undefined This checking mirrors what 349cc4a507c4d84fcadf61f42159ea6412717896 did for C defines.
2021-05-16 12:55:36 +03:00
u {{NOBODY_USER_NAME}} 65534 "Nobody" -
sysusers: add minimal tool to reconstruct /etc/passwd and /etc/group from static files systemd-sysusers is a tool to reconstruct /etc/passwd and /etc/group from static definition files that take a lot of inspiration from tmpfiles snippets. These snippets should carry information about system users only. To make sure it is not misused for normal users these snippets only allow configuring UID and gecos field for each user, but do not allow configuration of the home directory or shell, which is necessary for real login users. The purpose of this tool is to enable state-less systems that can populate /etc with the minimal files necessary, solely from static data in /usr. systemd-sysuser is additive only, and will never override existing users. This tool will create these files directly, and not via some user database abtsraction layer. This is appropriate as this tool is supposed to run really early at boot, and is only useful for creating system users, and system users cannot be stored in remote databases anyway. The tool is also useful to be invoked from RPM scriptlets, instead of useradd. This allows moving from imperative user descriptions in RPM to declarative descriptions. The UID/GID for a user/group to be created can either be chosen dynamic, or fixed, or be read from the owner of a file in the file system, in order to support reconstructing the correct IDs for files that shall be owned by them. This also adds a minimal user definition file, that should be sufficient for most basic systems. Distributions are expected to patch these files and augment the contents, for example with fixed UIDs for the users where that's necessary.
2014-06-13 00:54:02 +04:00
# Administrator group: can *see* more than normal users
sysusers: set home directory for root to /root
2014-08-19 18:38:43 +04:00
g adm - - -
sysusers: add minimal tool to reconstruct /etc/passwd and /etc/group from static files systemd-sysusers is a tool to reconstruct /etc/passwd and /etc/group from static definition files that take a lot of inspiration from tmpfiles snippets. These snippets should carry information about system users only. To make sure it is not misused for normal users these snippets only allow configuring UID and gecos field for each user, but do not allow configuration of the home directory or shell, which is necessary for real login users. The purpose of this tool is to enable state-less systems that can populate /etc with the minimal files necessary, solely from static data in /usr. systemd-sysuser is additive only, and will never override existing users. This tool will create these files directly, and not via some user database abtsraction layer. This is appropriate as this tool is supposed to run really early at boot, and is only useful for creating system users, and system users cannot be stored in remote databases anyway. The tool is also useful to be invoked from RPM scriptlets, instead of useradd. This allows moving from imperative user descriptions in RPM to declarative descriptions. The UID/GID for a user/group to be created can either be chosen dynamic, or fixed, or be read from the owner of a file in the file system, in order to support reconstructing the correct IDs for files that shall be owned by them. This also adds a minimal user definition file, that should be sufficient for most basic systems. Distributions are expected to patch these files and augment the contents, for example with fixed UIDs for the users where that's necessary.
2014-06-13 00:54:02 +04:00
# Administrator group: can *do* more than normal users
sysusers: set home directory for root to /root
2014-08-19 18:38:43 +04:00
g wheel - - -
sysusers: add minimal tool to reconstruct /etc/passwd and /etc/group from static files systemd-sysusers is a tool to reconstruct /etc/passwd and /etc/group from static definition files that take a lot of inspiration from tmpfiles snippets. These snippets should carry information about system users only. To make sure it is not misused for normal users these snippets only allow configuring UID and gecos field for each user, but do not allow configuration of the home directory or shell, which is necessary for real login users. The purpose of this tool is to enable state-less systems that can populate /etc with the minimal files necessary, solely from static data in /usr. systemd-sysuser is additive only, and will never override existing users. This tool will create these files directly, and not via some user database abtsraction layer. This is appropriate as this tool is supposed to run really early at boot, and is only useful for creating system users, and system users cannot be stored in remote databases anyway. The tool is also useful to be invoked from RPM scriptlets, instead of useradd. This allows moving from imperative user descriptions in RPM to declarative descriptions. The UID/GID for a user/group to be created can either be chosen dynamic, or fixed, or be read from the owner of a file in the file system, in order to support reconstructing the correct IDs for files that shall be owned by them. This also adds a minimal user definition file, that should be sufficient for most basic systems. Distributions are expected to patch these files and augment the contents, for example with fixed UIDs for the users where that's necessary.
2014-06-13 00:54:02 +04:00
# Access to certain kernel and userspace facilities
sysusers: set home directory for root to /root
2014-08-19 18:38:43 +04:00
g kmem - - -
meson: replace some m4 templates with jinja2 m4 was nice in '85, but the syntax feels a bit dated. Since we use python for meson, let's use a popular python templating engine to replace some m4 usage. A little nicety is that typos are caught: FAILED: sysusers.d/systemd-remote.conf /usr/bin/meson --internal exe --capture sysusers.d/systemd-remote.conf -- /home/zbyszek/src/systemd/tools/meson-render-jinja2.py config.h ../sysusers.d/systemd-remote.conf.j2 Traceback (most recent call last): File "/home/zbyszek/src/systemd/tools/meson-render-jinja2.py", line 28, in <module> print(render(sys.argv[2], defines)) File "/home/zbyszek/src/systemd/tools/meson-render-jinja2.py", line 24, in render return template.render(defines) File "/usr/lib/python3.9/site-packages/jinja2/environment.py", line 1090, in render self.environment.handle_exception() File "/usr/lib/python3.9/site-packages/jinja2/environment.py", line 832, in handle_exception reraise(*rewrite_traceback_stack(source=source)) File "/usr/lib/python3.9/site-packages/jinja2/_compat.py", line 28, in reraise raise value.with_traceback(tb) File "<template>", line 8, in top-level template code jinja2.exceptions.UndefinedError: 'HAVE_MICROHTTP' is undefined This checking mirrors what 349cc4a507c4d84fcadf61f42159ea6412717896 did for C defines.
2021-05-16 12:55:36 +03:00
g tty {{TTY_GID}} - -
sysusers: set home directory for root to /root
2014-08-19 18:38:43 +04:00
g utmp - - -
sysusers: add minimal tool to reconstruct /etc/passwd and /etc/group from static files systemd-sysusers is a tool to reconstruct /etc/passwd and /etc/group from static definition files that take a lot of inspiration from tmpfiles snippets. These snippets should carry information about system users only. To make sure it is not misused for normal users these snippets only allow configuring UID and gecos field for each user, but do not allow configuration of the home directory or shell, which is necessary for real login users. The purpose of this tool is to enable state-less systems that can populate /etc with the minimal files necessary, solely from static data in /usr. systemd-sysuser is additive only, and will never override existing users. This tool will create these files directly, and not via some user database abtsraction layer. This is appropriate as this tool is supposed to run really early at boot, and is only useful for creating system users, and system users cannot be stored in remote databases anyway. The tool is also useful to be invoked from RPM scriptlets, instead of useradd. This allows moving from imperative user descriptions in RPM to declarative descriptions. The UID/GID for a user/group to be created can either be chosen dynamic, or fixed, or be read from the owner of a file in the file system, in order to support reconstructing the correct IDs for files that shall be owned by them. This also adds a minimal user definition file, that should be sufficient for most basic systems. Distributions are expected to patch these files and augment the contents, for example with fixed UIDs for the users where that's necessary.
2014-06-13 00:54:02 +04:00
# Hardware access groups
sysusers: set home directory for root to /root
2014-08-19 18:38:43 +04:00
g audio - - -
g cdrom - - -
g dialout - - -
g disk - - -
g input - - -
rules: add a rule to set /dev/kvm access mode and ownership (#5597) Kernel default mode is 0600, but distributions change it to group kvm, mode either 0660 (e.g. Debian) or 0666 (e.g. Fedora). Both approaches have valid reasons (a stricter mode limits exposure to bugs in the kvm subsystem, a looser mode makes libvirt and other virtualization mechanisms work out of the box for unprivileged users over ssh). In Fedora the qemu package carries the relevant rule, but it's nicer to have it in systemd, so that the permissions are not dependent on the qemu package being installed. Use of packaged qemu binaries is not required to make use of /dev/kvm, e.g. it's possible to use a self-compiled qemu or some alternative. https://bugzilla.redhat.com/show_bug.cgi?id=1431876 To accomodate both approaches, add a rule to set the mode in 50-udev-default.rules, but allow the mode to be overridden with a --with-dev-kvm-mode configure rule. The default is 0660, as the (slightly) more secure option.
2017-03-27 13:34:24 +03:00
g kvm - - -
README,sysusers: complete and order list of default udev groups we need Let's make sure the list of default udev groups we need are ordered in README and in the sysusers.d snippet, and both are complete.
2017-11-20 14:30:42 +03:00
g lp - - -
g render - - -
udev: add default group for sgx enclave access Closes #18669. This creates a "well known" for sgx_enclave ownership. By doing this here we avoid the risk that various projects making use of the device will provide similar-but-slightly-incompatible installation instructions, in particular using different group names. ACLs are actually a better approach to grant access to users, but not in all cases, so we want to provide a standard group anyway. Mode is 0o660, not 0o666 because this is very new code and distributions are likely to not want to give full access to all users. This might change in the future, but being conservative is a good default in the beginning. Rules for /dev/sgx_provision will be provided by libsg-ae-pce: https://github.com/intel/linux-sgx/issues/678.
2021-03-09 21:06:18 +03:00
g sgx - - -
sysusers: set home directory for root to /root
2014-08-19 18:38:43 +04:00
g tape - - -
g video - - -
sysusers: add minimal tool to reconstruct /etc/passwd and /etc/group from static files systemd-sysusers is a tool to reconstruct /etc/passwd and /etc/group from static definition files that take a lot of inspiration from tmpfiles snippets. These snippets should carry information about system users only. To make sure it is not misused for normal users these snippets only allow configuring UID and gecos field for each user, but do not allow configuration of the home directory or shell, which is necessary for real login users. The purpose of this tool is to enable state-less systems that can populate /etc with the minimal files necessary, solely from static data in /usr. systemd-sysuser is additive only, and will never override existing users. This tool will create these files directly, and not via some user database abtsraction layer. This is appropriate as this tool is supposed to run really early at boot, and is only useful for creating system users, and system users cannot be stored in remote databases anyway. The tool is also useful to be invoked from RPM scriptlets, instead of useradd. This allows moving from imperative user descriptions in RPM to declarative descriptions. The UID/GID for a user/group to be created can either be chosen dynamic, or fixed, or be read from the owner of a file in the file system, in order to support reconstructing the correct IDs for files that shall be owned by them. This also adds a minimal user definition file, that should be sufficient for most basic systems. Distributions are expected to patch these files and augment the contents, for example with fixed UIDs for the users where that's necessary.
2014-06-13 00:54:02 +04:00
# Default group for normal users
meson: replace some m4 templates with jinja2 m4 was nice in '85, but the syntax feels a bit dated. Since we use python for meson, let's use a popular python templating engine to replace some m4 usage. A little nicety is that typos are caught: FAILED: sysusers.d/systemd-remote.conf /usr/bin/meson --internal exe --capture sysusers.d/systemd-remote.conf -- /home/zbyszek/src/systemd/tools/meson-render-jinja2.py config.h ../sysusers.d/systemd-remote.conf.j2 Traceback (most recent call last): File "/home/zbyszek/src/systemd/tools/meson-render-jinja2.py", line 28, in <module> print(render(sys.argv[2], defines)) File "/home/zbyszek/src/systemd/tools/meson-render-jinja2.py", line 24, in render return template.render(defines) File "/usr/lib/python3.9/site-packages/jinja2/environment.py", line 1090, in render self.environment.handle_exception() File "/usr/lib/python3.9/site-packages/jinja2/environment.py", line 832, in handle_exception reraise(*rewrite_traceback_stack(source=source)) File "/usr/lib/python3.9/site-packages/jinja2/_compat.py", line 28, in reraise raise value.with_traceback(tb) File "<template>", line 8, in top-level template code jinja2.exceptions.UndefinedError: 'HAVE_MICROHTTP' is undefined This checking mirrors what 349cc4a507c4d84fcadf61f42159ea6412717896 did for C defines.
2021-05-16 12:55:36 +03:00
g users {{USERS_GID}} - -
Copy Permalink