Bug 20138 - /etc should be configurable by --sysconfdir
Summary: /etc should be configurable by --sysconfdir
Status: UNCONFIRMED
Alias: None
Product: glibc
Classification: Unclassified
Component: libc (show other bugs)
Version: 2.23
: P2 enhancement
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-05-24 14:57 UTC by heroxbd@sohu.com
Modified: 2023-09-14 16:46 UTC (History)
4 users (show)

See Also:
Host:
Target:
Build:
Last reconfirmed:
fweimer: security-


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description heroxbd@sohu.com 2016-05-24 14:57:39 UTC
In files
"""
nis/nss_compat/compat-grp.c,
nis/nss_compat/compat-initgroups.c,
nis/nss_compat/compat-pwd.c,
nis/nss_compat/compat-spwd.c,
nss/bug-erange.c,
nss/nss_files/files-init.c,
nss/nss_files/files-initgroups.c,
resolv/netdb.h,
resolv/resolv.h,
shadow/lckpwdf.c,
sysdeps/generic/ldconfig.h
"""
/etc are hardcoded.  Configure accepts --sysconfdir, which should be able to override /etc inside these files.
Comment 1 James Le Cuirot 2023-09-14 16:46:06 UTC
Hi Benda. I noticed we were doing this in Gentoo when I found that getent was returning user/group entries from the prefix, rather than from /etc. I really don't think that makes sense, at least for passwd, group, and shadow. Some of the other files like services and resolv.conf are debatable.

For users and groups, the location of their names and other properties are determined by the libc in use, not by where the file/directory you're inspecting is. It would be really weird for "/path/to/prefix/bin/ls -l /home" to return completely different ownership information to "/bin/ls -l /home".

In Gentoo's case, prefix is typically managed by a single user, so the ownership of files within the prefix isn't that interesting. We also stub out the user/group management functions in the eclasses under Prefix so these files generally don't get populated anyway.

services is a typically static file and Gentoo Prefix is normally deployed on older systems, so it may make sense to use the newer prefixed version in this case.

I'm on the fence with resolv.conf. Having to configure DNS in two places is strange, but if you don't have root access and you don't like the DNS configuration you've been given, this gives you the power to change it.

Of course, you can always create a symlink, although the security around some of these files may prevent that from working. I think we should draw a line at passwd, group, and shadow in any case. What do you think?