Bug 104586

Summary:	Document best practices for usernames in <policy>
Product:	dbus	Reporter:	Simon McVittie <smcv>
Component:	core	Assignee:	D-Bus Maintainers <dbus>
Status:	RESOLVED MOVED	QA Contact:	D-Bus Maintainers <dbus>
Severity:	enhancement
Priority:	medium	CC:	teg
Version:	git master
Hardware:	Other
OS:	All
Whiteboard:
i915 platform:		i915 features:

Description Simon McVittie 2018-01-11 18:52:47 UTC

Because some NSS mechanisms require network access, and some network access mechanisms like NetworkManager require D-Bus, usernames in the <policy> for the dbus-daemon must be resolvable during boot prior to network access becoming available. In practice, this means they must be local (for example nss_files, nss_db, or even nss_systemd's special cases for the root and nobody users).

(In reply to Tom Gundersen on Bug #104224)
> As such, no dbus-based NSS resolution is possible. This is ok
> because we assume any user/group names used in the configuration files are
> given statically in /etc/passwd and friends, rather than resolved over
> something like LDAP (local policy referencing remote users sounds very
> strange). This is not at all obvious, and it is probably something we should
> document better. I'd even propose to add this to the spec if we all agreed.

dbus-daemon's XML configuration language is not (currently) in the scope of the spec, but I'd welcome patches to dbus-daemon(1) that said this.

Comment 1 Simon McVittie 2018-01-11 18:53:38 UTC

The same is true for group names, although group names appearing in <policy> are usually a code-smell (if you find yourself referring to group names then you should probably be using polkit instead).

Comment 2 GitLab Migration User 2018-10-12 21:32:28 UTC

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/dbus/dbus/issues/194.

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.