NSS chroot protection

[Florian Weimer]

In order to avoid security regressions, we disabled reloading of
/etc/nsswitch.conf after the chroot has changed.  We also went a step
further and disabled loading additional NSS modules based on the
*current* loaded configuration.

Apparently, that breaks a few chroot hacks that use incomplete chroots
for service confinement (rather than a complete operating system image).

Should we revert the second part and keep loading new service modules?

In a future glibc version, we could perhaps move files & dns into
libc.so.6, and reenable the load-inhibition feature for other modules
(that aren't files or dns).

Comments?

Thanks,
Florian
-- 
Red Hat GmbH, https://de.redhat.com/ , Registered seat: Grasbrunn,
Commercial register: Amtsgericht Muenchen, HRB 153243,
Managing Directors: Charles Cachera, Brian Klemm, Laurie Krebs, Michael O'Neill