shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2024-11-05 15:21:37 +03:00
Code
b062ca616c
systemd/man/nss-mymachines.xml

161 lines
7.6 KiB
XML
Raw Normal View History

man: document nss-mymachines
2015-01-07 19:40:10 +03:00
<?xml version='1.0'?> <!--*-nxml-*-->
man: use same header for all files The "include" files had type "book" for some raeason. I don't think this is meaningful. Let's just use the same everywhere. $ perl -i -0pe 's^..DOCTYPE (book|refentry) PUBLIC "-//OASIS//DTD DocBook XML V4.[25]//EN"\s+"http^<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"\n "http^gms' man/*.xml
2019-03-14 16:40:58 +03:00
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
man: revert dynamic paths for split-usr setups This did not really work out as we had hoped. Trying to do this upstream introduced several problems that probably makes it better suited as a downstream patch after all. At any rate, it is not releaseable in the current state, so we at least need to revert this before the release. * by adjusting the path to binaries, but not do the same thing to the search path we end up with inconsistent man-pages. Adjusting the search path too would be quite messy, and it is not at all obvious that this is worth the effort, but at any rate it would have to be done before we could ship this. * this means that distributed man-pages does not make sense as they depend on config options, and for better or worse we are still distributing man pages, so that is something that definitely needs sorting out before we could ship with this patch. * we have long held that split-usr is only minimally supported in order to boot, and something we hope will eventually go away. So before we start adding even more magic/effort in order to make this work nicely, we should probably question if it makes sense at all.
2015-06-18 20:47:44 +03:00
"http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd">
man: standarize on one-line license header No need to waste space, and uniformity is good. $ perl -i -0pe 's|\n+<!--\s*SPDX-License-Identifier: LGPL-2.1..\s*-->|\n<!-- SPDX-License-Identifier: LGPL-2.1+ -->|gms' man/*.xml
2019-03-14 16:29:37 +03:00
<!-- SPDX-License-Identifier: LGPL-2.1+ -->
man: document nss-mymachines
2015-01-07 19:40:10 +03:00
meson: allow building resolved and machined without nss modules This adds -Dnss-resolve= and -Dnss-mymachines= meson options. By using this option, e.g., resolved can be built without nss-resolve. When no nss modules are built, then test-nss is neither built. Also, This changes the option name -Dmyhostname= to -Dnss-myhostname= for consistency to other nss related options. Closes #9596.
2018-07-18 03:25:57 +03:00
<refentry id="nss-mymachines" conditional='ENABLE_NSS_MYMACHINES'>
man: document nss-mymachines
2015-01-07 19:40:10 +03:00
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
<refentryinfo>
<title>nss-mymachines</title>
<productname>systemd</productname>
</refentryinfo>
<refmeta>
<refentrytitle>nss-mymachines</refentrytitle>
<manvolnum>8</manvolnum>
</refmeta>
<refnamediv>
<refname>nss-mymachines</refname>
<refname>libnss_mymachines.so.2</refname>
<refpurpose>Provide hostname resolution for local
container instances.</refpurpose>
</refnamediv>
<refsynopsisdiv>
<para><filename>libnss_mymachines.so.2</filename></para>
</refsynopsisdiv>
<refsect1>
<title>Description</title>
man: change recommended order of NSS modules in /etc/nsswitch.conf So far we recommended placing "nss-mymachines" after "nss-resolve" in the order of preference in /etc/nsswitch.conf. This change reverse this order. Rationale: single-label names are resolved via LLMNR by resolved, which has to time out if no peer by that name exists. By placing "nss-mymachines" first (which always responds immediately) we avoid running into this timeout for most containers. Both modules should return the same data if LLMNR is used by the container anyway. While we are at it, improve the man pages of the three NSS modules in other ways a bit.
2016-02-23 20:24:03 +03:00
<para><command>nss-mymachines</command> is a plug-in module for the GNU Name Service Switch (NSS) functionality of
the GNU C Library (<command>glibc</command>), providing hostname resolution for the names of containers running
locally that are registered with
man: add an extensive example to nss-mymachines(8) The man page didn't really say what we are mapping and with what patterns. Let's fix that.
2018-11-29 14:28:02 +03:00
<citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>. The
man: change recommended order of NSS modules in /etc/nsswitch.conf So far we recommended placing "nss-mymachines" after "nss-resolve" in the order of preference in /etc/nsswitch.conf. This change reverse this order. Rationale: single-label names are resolved via LLMNR by resolved, which has to time out if no peer by that name exists. By placing "nss-mymachines" first (which always responds immediately) we avoid running into this timeout for most containers. Both modules should return the same data if LLMNR is used by the container anyway. While we are at it, improve the man pages of the three NSS modules in other ways a bit.
2016-02-23 20:24:03 +03:00
container names are resolved to the IP addresses of the specific container, ordered by their scope. This
man: add an extensive example to nss-mymachines(8) The man page didn't really say what we are mapping and with what patterns. Let's fix that.
2018-11-29 14:28:02 +03:00
functionality only applies to containers using network namespacing (see the description of
<option>--private-network</option> in
<citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>).
Note that the name that is resolved is the one registered with <command>systemd-machined</command>, which
may be different than the hostname configured inside of the container.</para>
<para>The module also provides name resolution for user and group identifiers mapped to containers. All names from
the range allocated to a given container <replaceable>container</replaceable> are exposed on the host as
<literal>vu-<replaceable>container</replaceable>-<replaceable>uid</replaceable></literal> and
<literal>vg-<replaceable>container</replaceable>-<replaceable>gid</replaceable></literal> (see example below). This
functionality only applies to containers using user namespacing (see the description of
<option>--private-users</option> in
<citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>).</para>
man: change recommended order of NSS modules in /etc/nsswitch.conf So far we recommended placing "nss-mymachines" after "nss-resolve" in the order of preference in /etc/nsswitch.conf. This change reverse this order. Rationale: single-label names are resolved via LLMNR by resolved, which has to time out if no peer by that name exists. By placing "nss-mymachines" first (which always responds immediately) we avoid running into this timeout for most containers. Both modules should return the same data if LLMNR is used by the container anyway. While we are at it, improve the man pages of the three NSS modules in other ways a bit.
2016-02-23 20:24:03 +03:00
<para>To activate the NSS module, add <literal>mymachines</literal> to the lines starting with
<literal>hosts:</literal>, <literal>passwd:</literal> and <literal>group:</literal> in
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
<filename>/etc/nsswitch.conf</filename>.</para>
man: change recommended order of NSS modules in /etc/nsswitch.conf So far we recommended placing "nss-mymachines" after "nss-resolve" in the order of preference in /etc/nsswitch.conf. This change reverse this order. Rationale: single-label names are resolved via LLMNR by resolved, which has to time out if no peer by that name exists. By placing "nss-mymachines" first (which always responds immediately) we avoid running into this timeout for most containers. Both modules should return the same data if LLMNR is used by the container anyway. While we are at it, improve the man pages of the three NSS modules in other ways a bit.
2016-02-23 20:24:03 +03:00
<para>It is recommended to place <literal>mymachines</literal> after the <literal>files</literal> or
<literal>compat</literal> entry of the <filename>/etc/nsswitch.conf</filename> lines to make sure that its mappings
are preferred over other resolvers such as DNS, but so that <filename>/etc/hosts</filename>,
<filename>/etc/passwd</filename> and <filename>/etc/group</filename> based mappings take precedence.</para>
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
</refsect1>
<refsect1>
man: add an extensive example to nss-mymachines(8) The man page didn't really say what we are mapping and with what patterns. Let's fix that.
2018-11-29 14:28:02 +03:00
<title>Configuration in <filename>/etc/nsswitch.conf</filename></title>
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
man: change recommended order of NSS modules in /etc/nsswitch.conf So far we recommended placing "nss-mymachines" after "nss-resolve" in the order of preference in /etc/nsswitch.conf. This change reverse this order. Rationale: single-label names are resolved via LLMNR by resolved, which has to time out if no peer by that name exists. By placing "nss-mymachines" first (which always responds immediately) we avoid running into this timeout for most containers. Both modules should return the same data if LLMNR is used by the container anyway. While we are at it, improve the man pages of the three NSS modules in other ways a bit.
2016-02-23 20:24:03 +03:00
<para>Here is an example <filename>/etc/nsswitch.conf</filename> file that enables
<command>nss-mymachines</command> correctly:</para>
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
man,factory: update factory config for nsswitch.conf to match the man pages Also add a note in the man pages to remind people to adjust the factory config and other man pages at the same time.
2018-11-27 19:02:20 +03:00
<!-- synchronize with other nss-* man pages and factory/etc/nsswitch.conf -->
nss: add new "nss-systemd" NSS module for mapping dynamic users With this NSS module all dynamic service users will be resolvable via NSS like any real user.
2016-07-14 20:19:49 +03:00
<programlisting>passwd: compat <command>mymachines</command> systemd
group: compat <command>mymachines</command> systemd
nss-mymachines: map userns users of containers to real user names Given a container "foo", that maps user id $UID to container user, using user namespaces, this NSS module extenstion will now map the $UID to a name "vu-foo-$TUID" for the translated UID $UID. Similar, userns groups are mapped to "vg-foo-$TGID" for translated GIDs of $GID. This simple change should make userns users more discoverable. Also, given that many tools like "adduser" check NSS before allocating a UID, should lower the chance of UID range conflicts between tools.
2015-07-09 20:46:20 +03:00
shadow: compat
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
man: sync up the suggested nsswitch.conf configuration for our four NSS modules This unifies the suggested nsswitch.conf configuration for our four NSS modules to this: hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname Note that this restores "myhostname" to the suggested configuration of nss-resolve for the time being, undoing 4484e1792b64b01614f04b7bde97bf019f601bf9. "myhostname" should probably be dropped eventually, but when we do this we should do it in full, and not only drop it from the suggested nsswitch.conf for one of the modules, but also drop it in source and stop referring to it altogether. Note that nss-resolve doesn't replace nss-myhostname in full: the former only works if D-Bus/resolved is available for resolving the local hostname, the latter works in all cases even if D-Bus or resolved are not in operation, hence there's some value in keeping the line as it is right now. Note that neither dns nor myhostname are considered at all with the above configuration unless the resolve module actually returns UNAVAIL. Thus, even though handling of local hostname resolving is implemented twice this way it is only executed once for each lookup.
2016-10-24 19:58:03 +03:00
hosts: files <command>mymachines</command> resolve [!UNAVAIL=return] dns myhostname
man: document nss-mymachines
2015-01-07 19:40:10 +03:00
networks: files
protocols: db files
services: db files
nss-mymachines: map userns users of containers to real user names Given a container "foo", that maps user id $UID to container user, using user namespaces, this NSS module extenstion will now map the $UID to a name "vu-foo-$TUID" for the translated UID $UID. Similar, userns groups are mapped to "vg-foo-$TGID" for translated GIDs of $GID. This simple change should make userns users more discoverable. Also, given that many tools like "adduser" check NSS before allocating a UID, should lower the chance of UID range conflicts between tools.
2015-07-09 20:46:20 +03:00
ethers: db files
rpc: db files
man: document nss-mymachines
2015-01-07 19:40:10 +03:00
netgroup: nis</programlisting>
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
</refsect1>
man: add an extensive example to nss-mymachines(8) The man page didn't really say what we are mapping and with what patterns. Let's fix that.
2018-11-29 14:28:02 +03:00
<refsect1>
<title>Mappings provided by <filename>nss-mymachines</filename></title>
<para>The container <literal>rawhide</literal> is spawned using
<citerefentry><refentrytitle>systemd-nspawn</refentrytitle><manvolnum>1</manvolnum></citerefentry>:
</para>
<programlisting># systemd-nspawn -M rawhide --boot --network-veth --private-users=pick
Spawning container rawhide on /var/lib/machines/rawhide.
Selected user namespace base 20119552 and range 65536.
...
$ machinectl --max-addresses=3
MACHINE CLASS SERVICE OS VERSION ADDRESSES
rawhide container systemd-nspawn fedora 30 169.254.40.164 fe80::94aa:3aff:fe7b:d4b9
$ getent passwd vu-rawhide-0 vu-rawhide-81
meson: make nologin path build time configurable Some distros install nologin as /usr/sbin/nologin, others as /sbin/nologin. Since we can't really on merged-usr everywhere (where the path wouldn't matter), make the path build time configurable via -Dnologin-path=. Closes #13028
2019-07-18 02:24:00 +03:00
vu-rawhide-0:*:20119552:65534:vu-rawhide-0:/:/usr/sbin/nologin
vu-rawhide-81:*:20119633:65534:vu-rawhide-81:/:/usr/sbin/nologin
man: add an extensive example to nss-mymachines(8) The man page didn't really say what we are mapping and with what patterns. Let's fix that.
2018-11-29 14:28:02 +03:00
$ getent group vg-rawhide-0 vg-rawhide-81
vg-rawhide-0:*:20119552:
vg-rawhide-81:*:20119633:
$ ps -o user:15,pid,tty,command -e|grep '^vu-rawhide'
vu-rawhide-0 692 ? /usr/lib/systemd/systemd
vu-rawhide-0 731 ? /usr/lib/systemd/systemd-journald
vu-rawhide-192 734 ? /usr/lib/systemd/systemd-networkd
vu-rawhide-193 738 ? /usr/lib/systemd/systemd-resolved
vu-rawhide-0 742 ? /usr/lib/systemd/systemd-logind
vu-rawhide-81 744 ? /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
vu-rawhide-0 746 ? /usr/sbin/sshd -D ...
vu-rawhide-0 752 ? /usr/lib/systemd/systemd --user
vu-rawhide-0 753 ? (sd-pam)
vu-rawhide-0 1628 ? login -- zbyszek
vu-rawhide-1000 1630 ? /usr/lib/systemd/systemd --user
vu-rawhide-1000 1631 ? (sd-pam)
vu-rawhide-1000 1637 pts/8 -zsh
$ ping -c1 rawhide
PING rawhide(fe80::94aa:3aff:fe7b:d4b9%ve-rawhide (fe80::94aa:3aff:fe7b:d4b9%ve-rawhide)) 56 data bytes
64 bytes from fe80::94aa:3aff:fe7b:d4b9%ve-rawhide (fe80::94aa:3aff:fe7b:d4b9%ve-rawhide): icmp_seq=1 ttl=64 time=0.045 ms
...
$ ping -c1 -4 rawhide
PING rawhide (169.254.40.164) 56(84) bytes of data.
64 bytes from 169.254.40.164 (169.254.40.164): icmp_seq=1 ttl=64 time=0.064 ms
...
# machinectl shell rawhide /sbin/ip a
Connected to machine rawhide. Press ^] three times within 1s to exit session.
1: lo: &lt;LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
...
2: host0@if21: &lt;BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
link/ether 96:aa:3a:7b:d4:b9 brd ff:ff:ff:ff:ff:ff link-netnsid 0
inet 169.254.40.164/16 brd 169.254.255.255 scope link host0
valid_lft forever preferred_lft forever
inet6 fe80::94aa:3aff:fe7b:d4b9/64 scope link
valid_lft forever preferred_lft forever
Connection to machine rawhide terminated.
</programlisting>
</refsect1>
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
<refsect1>
<title>See Also</title>
<para>
<citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
<citerefentry><refentrytitle>systemd-machined.service</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
man: add an extensive example to nss-mymachines(8) The man page didn't really say what we are mapping and with what patterns. Let's fix that.
2018-11-29 14:28:02 +03:00
<citerefentry><refentrytitle>machinectl</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
nss: add new "nss-systemd" NSS module for mapping dynamic users With this NSS module all dynamic service users will be resolvable via NSS like any real user.
2016-07-14 20:19:49 +03:00
<citerefentry><refentrytitle>nss-systemd</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
man: document nss-resolve
2015-08-26 12:00:09 +03:00
<citerefentry><refentrytitle>nss-resolve</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
Reindent man pages to 2ch
2015-02-04 05:14:13 +03:00
<citerefentry><refentrytitle>nss-myhostname</refentrytitle><manvolnum>8</manvolnum></citerefentry>,
<citerefentry project='man-pages'><refentrytitle>nsswitch.conf</refentrytitle><manvolnum>5</manvolnum></citerefentry>,
<citerefentry project='man-pages'><refentrytitle>getent</refentrytitle><manvolnum>1</manvolnum></citerefentry>
</para>
</refsect1>
man: document nss-mymachines
2015-01-07 19:40:10 +03:00
</refentry>
Copy Permalink