From e65cf4e9d68dd4526524b33709bd16afb95f374a Mon Sep 17 00:00:00 2001

From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>

Date: Thu, 10 Jul 2014 08:50:32 -0400

Subject: [PATCH] sysusers: allow overrides in /etc and /run

An administrator might want to block a certain sysusers config file from

being executed, e.g. to block the creation of a certain user.

Only a relatively short description is added in the man page, since

overrides should be relatively rare.

(cherry picked from commit 938a560b7608e8906134ed7d717c3f5aa459a760)

---

 man/sysusers.d.xml      | 63 ++++++++++++++++++++++++++++++++++---------------

 src/sysusers/sysusers.c |  2 ++

 2 files changed, 46 insertions(+), 19 deletions(-)

diff --git a/man/sysusers.d.xml b/man/sysusers.d.xml

index 40f8715bc0..00eb7ec942 100644

--- a/man/sysusers.d.xml

+++ b/man/sysusers.d.xml

@@ -53,32 +53,28 @@

                 <title>Description</title>

                 <para><command>systemd-sysusers</command> uses the

-                files from <filename>/usr/lib/sysusers.d/</filename>

+                files from <filename>sysusers.d</filename> directory

                 to create system users and groups at package

-                installation or boot time. This tool may be used for

-                allocating system users and groups only, it is not

+                installation or boot time. This tool may be used to

+                allocate system users and groups only, it is not

                 useful for creating non-system users and groups, as it

-                accessed <filename>/etc/passwd</filename> and

+                accesses <filename>/etc/passwd</filename> and

                 <filename>/etc/group</filename> directly, bypassing

-                any more complex user database, for example any

+                any more complex user databases, for example any

                 database involving NIS or LDAP.</para>

-

         </refsect1>

         <refsect1>

-                <title>File Format</title>

-

-                <para>Each file shall be named in the style of

-                <filename><replaceable>package</replaceable>.conf</filename>.</para>

+                <title>Configuration Format</title>

-                <para>All files are sorted by their filename in

-                lexicographic order, regardless of which of the

-                directories they reside in. If multiple files specify

-                the same user or group, the entry in the file with the

-                lexicographically earliest name will be applied, all

-                all other conflicting entries will be logged as

-                errors. Users and groups are

-                processed in the order they are listed.</para>

+                <para>Each configuration file shall be named in the

+                style of

+                <filename><replaceable>package</replaceable>.conf</filename>

+                or

+                <filename><replaceable>package</replaceable>-<replaceable>part</replaceable>.conf</filename>.

+                The second variant should be used when it is desirable

+                to make it easy to override just this part of

+                configuration.</para>

                 <para>The file format is one line per user or group

                 containing name, ID and GECOS field description:</para>

@@ -193,10 +189,39 @@ m authd input</programlisting>

         </refsect1>

         <refsect1>

+                <title>Overriding vendor configuration</title>

+

+                <para>Note that <command>systemd-sysusers</command>

+                will do nothing if the specified users or groups

+                already exist, so normally there no reason to override

+                <filename>sysusers.d</filename> vendor configuration,

+                except to block certain users or groups from being

+                created.</para>

+

+                <para>Files in <filename>/etc/sysusers.d</filename>

+                override files with the same name in

+                <filename>/usr/lib/sysusers.d</filename> and

+                <filename>/run/sysusers.d</filename>. Files in

+                <filename>/run/sysusers.d</filename> override files

+                with the same name in

+                <filename>/usr/lib/sysusers.d</filename>. The scheme is the same as for

+                <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>,

+                except for the directory name.</para>

+

+                <para>If the administrator wants to disable a

+                configuration file supplied by the vendor, the

+                recommended way is to place a symlink to

+                <filename>/dev/null</filename> in

+                <filename>/etc/sysusers.d/</filename> bearing the

+                same filename.</para>

+        </refsect1>

+

+        <refsect1>

                 <title>See Also</title>

                 <para>

                         <citerefentry><refentrytitle>systemd</refentrytitle><manvolnum>1</manvolnum></citerefentry>,

-                        <citerefentry><refentrytitle>systemd-sysusers</refentrytitle><manvolnum>8</manvolnum></citerefentry>

+                        <citerefentry><refentrytitle>systemd-sysusers</refentrytitle><manvolnum>8</manvolnum></citerefentry>,

+                        <citerefentry><refentrytitle>tmpfiles.d</refentrytitle><manvolnum>5</manvolnum></citerefentry>

                 </para>

         </refsect1>

diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c

index 16ea0c9c57..61c9bb5efb 100644

--- a/src/sysusers/sysusers.c

+++ b/src/sysusers/sysusers.c

@@ -62,6 +62,8 @@ typedef struct Item {

 static char *arg_root = NULL;

 static const char conf_file_dirs[] =

+        "/etc/sysusers.d\0"

+        "/run/sysusers.d\0"

         "/usr/local/lib/sysusers.d\0"

         "/usr/lib/sysusers.d\0"

 #ifdef HAVE_SPLIT_USR