[PATCH] nss: look for databases in /usr/share/ if they don't exist in /etc/

[Florian Weimer]

* Lennart Poettering:

> On Fr, 27.09.24 10:54, Florian Weimer (fweimer@redhat.com) wrote:
>
>> * Lennart Poettering:
>>
>> > In order to improve compatibility with systems that implement a
>> > hermetic /usr/, this changes glibc NSS code to always look for its
>> > databases files in /usr/share/ too in case they don't exist (ENOENT) in
>> > /etc/. This allows distributions to move /etc/protocols and similar
>> > data files into /usr/share/. These days various of these files are kinda
>> > static anyway, and hence in many cases are better placed below the /usr/
>> > hierarchy than below the configurable /etc/.
>>
>> We don't really know what's in /usr/share.  There's some evidence that
>> /usr/share/services/ was used as a directory at one point.  The patch
>> isn't directly incompatible with that, it's just that it can't be used
>> to move /etc/services to /usr/share/services on such systems.
>>
>> Can we use a subdirectory of /usr/share instead, or perhaps /usr/etc?
>
> Hmm, maybe it makes sense to treat NSS databases as something slightly
> distinct from other config files in /etc/, hence, maybe let's use
> /usr/share/nss/ for this, to indicate this is about nss databases?
> After all these files are similarly structured, have similar
> (sometimes identical) parsers, but have no file suffix that would tell
> us that. By placing them in a new subdir of /usr/share/ called "nss"
> we could communicate this similarity in structure a bit?

The Netscape Security Services do not use /usr/share/nss, so that should
work.

> (Not too keen on /usr/etc/ because that introduces yet another
> high-level hierarchy in /usr/. Maybe /usr/share/etc/ might be a middle
> ground?)

I think openSUSE has been using /usr/etc for many years.  See “System
Databases (rpc, services, protocols)” in
<https://kubic.opensuse.org/blog/2019-12-05-usr-etc/>, and
<https://github.com/openSUSE/libnss_usrfiles>, particularly list of
pathnames there.  Cc:ing Thorsten.

I don't particularly like /usr/etc because it is inconsistent with
UsrMove (from a certain perspective), but this dislike doesn't go to the
level that we need to be incompatible with existing deployments.

Thanks,
Florian