On Mi, 28.05.25 12:34, Alexander Bokovoy (abokovoy@xxxxxxxxxx) wrote:
> > a group record it will combine a specific userdb group record from one
> > backend with the results of a matching GetMemberships() of *all*
> > backends and return that as one "struct group" NSS record. Or in other
> > words: .gr_name, .gr_passwd, .gr_gid are initialized from the group
> > record JSON object, but .gr_mem is initialized from the combination of
> > the results of all GetMemberships() IPC calls.
>
> That was my expectation as well, but the result you see in my email is
> what I get on Fedora enrolled into IPA.
>
> In addition to that, `getent -s systemd initgroups abokovoy` does not return
> any group membership at all:
>
> $ strace -f -s 1024 -e trace=%net getent -s systemd initgroups abokovoy
> ...
> socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 4
> connect(4, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.DynamicUser"}, 45) = 0
> socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 7
> connect(7, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.NamespaceResource"}, 51) = 0
> socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 8
> connect(8, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.DropIn"}, 40) = 0
> socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 9
> connect(9, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.Home"}, 38) = 0
> socket(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK, 0) = 10
> connect(10, {sa_family=AF_UNIX, sun_path="/run/systemd/userdb/io.systemd.Machine"}, 41) = 0
Note sure I follow? This trace shows only systemd's own five userdb
implementations, none provided by sssd? And you used "-s systemd" on
the getent cmdline, hence you prohibit NSS to ever query anything else
but systemd's userdb.
hence of course you are not getting any sssd records, because you
don't have the userdb socket for it around, and you don't want the NSS
logic to talk to anything but userbd either?
Lennart
--
Lennart Poettering, Berlin
--
_______________________________________________
devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx
To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx
Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx
Do not reply to spam, report it: https://pagure.io/fedora-infrastructure/new_issue
