[PATCH v2 00/23] NSS, nscd updates (for group merging and more)

[Florian Weimer]

* Carlos O'Donell:

> On 3/20/26 4:40 PM, Florian Weimer wrote:
>> This is an enhanced rework of my previous series:
>>    RFC: Towards deprecating the ERANGE protocol for NSS
>>    <https://inbox.sourceware.org/libc-alpha/cover.1764012721.git.fweimer@redhat.com/>
>> The new version covers passwd and group.  It should have a proper
>> software TM for the shared nscd mapping for those two nscd databases,
>> following the same approach that we use in _dl_find_object.
>> The existing nscd test is enhanced with checks that the shared cache
>> actually works, by examining the statistics counters.
>> In the nscd client code, I switched the ad-hoc read-write lock to a
>> the
>> real one from <pthread.h> (still under the __libc_rwlock_* alias).  This
>> simplifies the code quite a bit and removes a few corner cases where the
>> old code was busy-waiting.
>> The reworked group merging code is still included, that part has not
>> changed.
>> One thing that is annoying is the GLIBC_2.1.2 compatibility version
>> that
>> we need for the *_r functions.  I had not noticed the need for that
>> before.  This is quite a blob of extra code per *_r function, so I think
>> we should generate that, but perhaps not with the preprocessor.
>
> Fails pre-commit CI. May you please have a look?
> https://patchwork.sourceware.org/project/glibc/patch/05e0a557343d05d4406b3776e13af4b1147b1541.1774037705.git.fweimer@redhat.com/
>
> The failure is across all 3 testers so it looks reproducible.

The test nss/tst-nss-does-not-exist fails with systemd-resolved because
due to the unqualified host name for negative testing, it search
who-knows-where for a name.  Switching to does-not-exist.example.com or
similar will fix this.

The nss/tst-getpw failure is more interesting.  I followed the rule “no
library function sets errno to zero”, but this is not what the test
expects:

  ret = getpw (uid, buf);

  /* Successfully read a password line.  */
  if (ret == 0 && !seen_hit)
    {
      printf ("PASS: Read a password line given a uid.\n");
      seen_hit = true;
    }

  /* Failed to read a password line. Why?  */
  if (ret == -1)
    {
      /* No entry?  Technically the errno could be any number
	 of values including ESRCH, EBADP or EPERM depending
	 on the quality of the nss module that implements the
	 underlying lookup. It should be 0 for getpw.*/
      if (errno == 0 && !seen_miss)
	{
	  printf ("PASS: Found an invalid uid.\n");
	  seen_miss = true;
	  return;
	}

So this appears to assume that errno is set to zero on failure.  The
test doesn't set errno to zero, and with a non-zero errno (ENOENT in my
case), it gets stuck.  This again depends on the system's NSS modules.

I don't know if this is a test bug.  I need to figure out where the zero
value comes from before my changes.

Thanks,
Florian