usermod --add-subuids fails for users not in /etc/passwd

[kevin gunn]

[SRU justification]
The (distro patched) subuid/subgid support in the shadow 'usermod' command only works with users present in /etc/passwd. As /etc/subuid and /etc/subgid are separate databases that do not require modification of /etc/passwd, this is an unnecessary restriction that appears to be due to a simple logic bug in the patch and not as a deliberate design decision. As Ubuntu Touch and Ubuntu Snappy systems will as a class have users in different NSS backends from /etc/passwd, and lxc should be supported for these users with uid namespacing, this bug warrants fixing.

[Test case]
1. Install the libnss-extrausers package
2. Enable it by running "sudo sed -i -e'/passwd:/ s/$/ extrausers/' /etc/nsswitch.conf"
3. Create a test user by running "echo 'testuser:x:2000:2000::/nonexistent:/bin/false' | sudo tee /var/lib/extrausers/passwd"
4. Attempt to add subuids for this user by running "sudo usermod --add-subuids 10000-12000 testuser"
5. Confirm that this fails with the error message "usermod: user 'testuser' does not exist in /etc/passwd"
6. Install the new version of the 'passwd' package
7. Repeat the test from step 4
8. Confirm that the command now succeeds, and the user's entry has been added to /etc/subuid
9. Clean up by running 'sudo usermod --del-subuids 10000-12000 testuser" and removing the /var/lib/extrausers/passwd file

[Regression potential]
This is a targeted bugfix in the behavior of usermod, and users are unlikely to be relying on the usermod command failing for non-local users.

[Original report]
currently we have need to utilize lxc on vivid+stable overlay which requires adding subuser & subgroup ids.
unfortunately, usermod currently fails since phablet password is readonly

[Steve Langasek (vorlon)]

This appears to be an issue with the patches to shadow for subuid/subgid support. The --{add,del}-sub{uid,gid}s options don't operate on /etc/passwd, only on /etc/sub{uid,gid}; but the code causes usermod to fail if called for any non-local user.

Assuming there's no policy reason why non-local users are disallowed from /etc/sub{uid,gid}, this is a simple fix. Cc:ing Serge Hallyn for comment, as he originally pulled these patches in.

[Serge Hallyn (serge-hallyn)]

Thanks, no objection from me.

[Launchpad Janitor (janitor)]

This bug was fixed in the package shadow - 1:4.1.5.1-1.1ubuntu7

---------------
shadow (1:4.1.5.1-1.1ubuntu7) wily; urgency=medium

  * debian/patches/userns/subuids-nonlocal-users: Don't limit
    subuid/subgid support to local users. Closes LP: #1475749.

 -- Steve Langasek <email address hidden> Mon, 20 Jul 2015 18:44:12 -0700

[Chris J Arges (arges)]

Hello kevin, or anyone else affected,

Accepted shadow into vivid-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/shadow/1:4.1.5.1-1.1ubuntu4.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Ubuntu Foundations Team Bug Bot (crichton)]

As a part of the Stable Release Updates quality process a search for Launchpad bug reports using the version of shadow from vivid-proposed was performed and bug 1493590 was found. Please investigate this bug report to ensure that a regression will not be created by this SRU. In the event that this is not a regression remove the "verification-failed" tag from this bug report and tag 1493590 "bot-stop-nagging". Thanks!

[Serge Hallyn (serge-hallyn)]

(sorry, i msread the bug history)

[Serge Hallyn (serge-hallyn)]

The test case in the Description passed cleanly for me (and failed without -proposed)

[Launchpad Janitor (janitor)]

This bug was fixed in the package shadow - 1:4.1.5.1-1.1ubuntu4.1

---------------
shadow (1:4.1.5.1-1.1ubuntu4.1) vivid; urgency=medium

  * debian/patches/userns/subuids-nonlocal-users: Don't limit
    subuid/subgid support to local users. Closes LP: #1475749.

 -- Steve Langasek <email address hidden> Mon, 20 Jul 2015 22:58:18 -0700

[Chris J Arges (arges)]

The verification of the Stable Release Update for shadow has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.