Skip to content
Snippets Groups Projects
  • Simon McVittie's avatar
    23a52654
    pressure-vessel: Generate /etc/passwd, /etc/group for the container · 23a52654
    Simon McVittie authored
    Sometimes our current uid will not be present in /etc/passwd.
    For example, when using systemd-homed the equivalent of a passwd(5)
    record is synthesized by libnss_systemd. A similar thing could happen
    when using a remote user directory like LDAP, or for the group database.
    
    Inside the container, we have the basic nsswitch plugins from glibc
    (notably libnss_files, which reads /etc/passwd and /etc/group), but
    we do not have access to non-standard nsswitch plugins like
    libnss_systemd or LDAP. This can cause crashes or bugs in games that
    assume that `getpwuid(getuid())` will always succeed (like Factorio),
    especially if they do not respect `$HOME` (like Factorio).
    
    Instead of bind-mounting the host system's /etc/passwd and /etc/group
    as-is, we can synthesize a /etc/passwd and /etc/group that are
    guaranteed to contain at least our uid and primary gid, matching what
    Flatpak does.
    
    Flatpak generates very minimal files that list our uid and gid, plus
    the default overflow uid and gid 65534 (labelled as `nfsnobody` for
    historical reasons). However, pressure-vessel has historically provided
    more complete files, so it's conceivable that a game might be relying
    on being able to resolve (for example) root as uid 0; so we copy
    everything from the host /etc/passwd and /etc/group, excluding only
    the line(s) that would duplicate the one we synthesize.
    
    Resolves: https://github.com/ValveSoftware/steam-runtime/issues/705
    
    
    Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>
    23a52654
    History
    pressure-vessel: Generate /etc/passwd, /etc/group for the container
    Simon McVittie authored
    Sometimes our current uid will not be present in /etc/passwd.
    For example, when using systemd-homed the equivalent of a passwd(5)
    record is synthesized by libnss_systemd. A similar thing could happen
    when using a remote user directory like LDAP, or for the group database.
    
    Inside the container, we have the basic nsswitch plugins from glibc
    (notably libnss_files, which reads /etc/passwd and /etc/group), but
    we do not have access to non-standard nsswitch plugins like
    libnss_systemd or LDAP. This can cause crashes or bugs in games that
    assume that `getpwuid(getuid())` will always succeed (like Factorio),
    especially if they do not respect `$HOME` (like Factorio).
    
    Instead of bind-mounting the host system's /etc/passwd and /etc/group
    as-is, we can synthesize a /etc/passwd and /etc/group that are
    guaranteed to contain at least our uid and primary gid, matching what
    Flatpak does.
    
    Flatpak generates very minimal files that list our uid and gid, plus
    the default overflow uid and gid 65534 (labelled as `nfsnobody` for
    historical reasons). However, pressure-vessel has historically provided
    more complete files, so it's conceivable that a game might be relying
    on being able to resolve (for example) root as uid 0; so we copy
    everything from the host /etc/passwd and /etc/group, excluding only
    the line(s) that would duplicate the one we synthesize.
    
    Resolves: https://github.com/ValveSoftware/steam-runtime/issues/705
    
    
    Signed-off-by: default avatarSimon McVittie <smcv@collabora.com>