getent does not support extrausers on uc18

[Ian Johnson]

for example, see this test:

```
user@coreimg:~$ snap run --shell docker
user@coreimg:/home/user$ grep docker /var/lib/extrausers/group
docker:x:113:
user@coreimg:/home/user$ grep docker /etc/group
user@coreimg:/home/user$ getent group docker
user@coreimg:/home/user$
```

with a modified version of the core18 snap to move the docker gid definition from /etc/group to /var/lib/extrausers/group, this was based on the edge channel revision 1888 on arm64.

[Zygmunt Krynicki (zyga)]

All of extrausers logic seems to be in the patch ./debian/patches/1010_extrausers.patch of the shadow source package. I wonder if this is simply lost in the ubuntu 18.04 archive (I had this patch on 20.10). Should this be something we ask foundations to SRU?

[Ian Johnson (anonymouse67)]

I added glibc since getent seems to come from libc-bin, which launchpad tells me is tracked with glibc package?

Anyways, yes I think this is something we should strongly consider backporting if the patch is already available in (at latest) groovy.

[Ian Johnson (anonymouse67)]

The patch does not seem to be in focal, at least it is not in the current core20 snap.

[James Henstridge (jamesh)]

getent isn't the problem here: it is just returning whatever data the nameservice switch provides.

The underlying cause is that libnss-extrausers ignores entries in the extrausers database that have a uid or gid less than 500:

https://git.launchpad.net/ubuntu/+source/libnss-extrausers/tree/s_config.h

The docker user and group as defined fall into that category.

It's not at all clear that it's a good idea to have low ID users and groups in extrausers anyway: it seems like it's just asking for conflicts with future updates of the base snap.

[Ian Johnson (anonymouse67)]

As explained by James, this is not really a bug with getent or nss-extrausers, it is operating by design, as such closing this bug.