usermod --add-subuids fails for users not in /etc/passwd
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| Canonical System Image |
Fix Released
|
High
|
Unassigned | ||
| shadow (Ubuntu) |
Fix Released
|
High
|
Steve Langasek | ||
| Vivid |
Fix Released
|
High
|
Unassigned | ||
Bug Description
[SRU justification]
The (distro patched) subuid/subgid support in the shadow 'usermod' command only works with users present in /etc/passwd. As /etc/subuid and /etc/subgid are separate databases that do not require modification of /etc/passwd, this is an unnecessary restriction that appears to be due to a simple logic bug in the patch and not as a deliberate design decision. As Ubuntu Touch and Ubuntu Snappy systems will as a class have users in different NSS backends from /etc/passwd, and lxc should be supported for these users with uid namespacing, this bug warrants fixing.
[Test case]
1. Install the libnss-extrausers package
2. Enable it by running "sudo sed -i -e'/passwd:/ s/$/ extrausers/' /etc/nsswitch.conf"
3. Create a test user by running "echo 'testuser:
4. Attempt to add subuids for this user by running "sudo usermod --add-subuids 10000-12000 testuser"
5. Confirm that this fails with the error message "usermod: user 'testuser' does not exist in /etc/passwd"
6. Install the new version of the 'passwd' package
7. Repeat the test from step 4
8. Confirm that the command now succeeds, and the user's entry has been added to /etc/subuid
9. Clean up by running 'sudo usermod --del-subuids 10000-12000 testuser" and removing the /var/lib/
[Regression potential]
This is a targeted bugfix in the behavior of usermod, and users are unlikely to be relying on the usermod command failing for non-local users.
[Original report]
currently we have need to utilize lxc on vivid+stable overlay which requires adding subuser & subgroup ids.
unfortunately, usermod currently fails since phablet password is readonly
Related branches
- Serge Hallyn: Approve
- Ubuntu branches: Pending requested
-
Diff: 167 lines (+146/-0)3 files modifieddebian/changelog (+7/-0)
debian/patches/series (+1/-0)
debian/patches/userns/subuids-nonlocal-users (+138/-0)
| Changed in canonical-devices-system-image: | |
| importance: | Undecided → High |
| Changed in shadow (Ubuntu): | |
| importance: | Undecided → High |
| summary: |
- changes to phablet to enable moduser on vivid+stable overlay ppa + usermod --add-subuids fails for users not in /etc/passwd |
| Steve Langasek (vorlon) wrote | #1 |
| Serge Hallyn (serge-hallyn) wrote | #2 |
| Changed in shadow (Ubuntu): | |
| status: | New → Triaged |
| description: | updated |
| description: | updated |
| Launchpad Janitor (janitor) wrote | #3 |
| Changed in shadow (Ubuntu): | |
| status: | Triaged → Fix Released |
| Chris J Arges (arges) wrote Please test proposed package | #4 |
| Changed in shadow (Ubuntu Vivid): | |
| status: | New → Fix Committed |
| tags: | added: verification-needed |
| Ubuntu Foundations Team Bug Bot (crichton) wrote [shadow/vivid] possible regression found | #5 |
| tags: | added: verification-failed |
| tags: |
added: bot-stop-nagging removed: verification-failed |
| tags: | added: verification-failed |
| tags: | removed: verification-failed |
| Changed in canonical-devices-system-image: | |
| status: | New → Fix Released |
| Changed in shadow (Ubuntu Vivid): | |
| importance: | Undecided → High |
| tags: |
added: vivid removed: bot-stop-nagging |
| Changed in shadow (Ubuntu Vivid): | |
| status: | Fix Committed → Confirmed |
| Serge Hallyn (serge-hallyn) wrote | #7 |
| Changed in shadow (Ubuntu Vivid): | |
| status: | Confirmed → Fix Committed |
| Serge Hallyn (serge-hallyn) wrote | #8 |
| tags: |
added: verification-done removed: verification-needed |
| Launchpad Janitor (janitor) wrote | #9 |
| Changed in shadow (Ubuntu Vivid): | |
| status: | Fix Committed → Fix Released |
| Chris J Arges (arges) wrote Update Released | #10 |
This appears to be an issue with the patches to shadow for subuid/subgid support. The --{add,
Assuming there's no policy reason why non-local users are disallowed from /etc/sub{uid,gid}, this is a simple fix. Cc:ing Serge Hallyn for comment, as he originally pulled these patches in.