adduser should support managing additional password/shadow/group files from libnss-extrausers

[Oliver Grawert]

with our readonly system-image setup when adding a user or changing a password using the /etc/{passwd,shadow,group} is not actually possible.
we plan to solve this via using libnss-extrausers and patching the config in /etc/nsswitch.conf at image build-time. this way we can make /var/lib/extrausers writable and use passwd,shadow and group from there.

unfortunately adduser is not able to operate on these files in the non-standard location. to set a user password (for having a properly working lock screen), add new users or drop the "nopasswordlogin" group from the phablet user it needs to learn handling these files so that we do not need to use weird hacks to manage users on system-image installs.

[Michael Terry (mterry)]

Poke on this. We'd like to land support for using PAM on the phone within the next few weeks.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Dimitri John Ledkov (xnox)]

Hm. I don't think I like this patch =)

In Clearlinux.org we use nss-altfiles, not extrausers project. And I have extensively patched shadow to support altfiles. Ideally I would like that support to be reviewed and landed upstream. Specifically all system accounts & groups are defined in altfiles, yet one can do things like "add this system account to this system group" in which case relevant stanzas from system data files is copied and stored in files under /etc/.

Can we merge this support in shadow? At the moment it seems like clearlinux.org, ubuntu (snappy), fedora (atomic) are using altfiles/extrausers and all would want proper support in shadow of setups with split system-provided accounts & user/admin modified accounts.

[Oliver Grawert (ogra)]

does nss-altfiles allow us to keep a readonly locked down /etc/passwd|shadow|group|gshadow ? it is pretty essential that adduser can not change system accounts that are in one of the above files in our readonly setup, can nss-altfiles provide such a level of lockdown ?

[Steve Langasek (vorlon)]

Once the dust has settled on the implementation, I think we want to look at whether this is SRUable to vivid for use in core and phone there.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.