<jlebon>
spresti[m]: one semi-convention for test failure tracker issues btw is to add the console and journal logs as attachments. that way others can easily also take a look and help diagnose
<dustymabe>
👍
nbsadminaccount- has quit [Quit: You have been kicked for being idle]
paragan has quit [Quit: Leaving]
<spresti[m]>
jlebon: ok I will see about adding those :)
vgoyal has joined #fedora-coreos
c4rt0_ has quit [Remote host closed the connection]
<spresti[m]>
jlebon: ok I updated with the documents, going to go ahead and look into posting a BZ dustymabe
<dustymabe>
spresti[m]: awesome! i'm going to grab some food, will help out if you need it when I get back
<spresti[m]>
Kk, I will let you know!
jpn has joined #fedora-coreos
<spresti[m]>
Honestly I might want some help posting the BZ as I am not sure what team to post it to?
<spresti[m]>
The only team I found was Red Hat Enterprise Linux Fast Datapath: which has "SElinux policy for OVS" as one of the rpms it supports.
<spresti[m]>
After clicking into making a BZ for them I became less confident that that was the correct team to put a bz against? sigh what am I missing?
<ravanelli>
dustymabe: I don't, but I can ask around. I would say, it is probably ppc64le backports/fix things.
npcomp has quit [Ping timeout: 256 seconds]
<dustymabe>
spresti[m]: go to https://bugzilla.redhat.com/ -> "File a Bug" -> "Fedora" -> "Fedora" -> Under "Component" select "selinux-policy"
<dustymabe>
then fill out the summary and description
<dustymabe>
ravanelli: thanks!
npcomp has joined #fedora-coreos
frigo has joined #fedora-coreos
<alebastr[m]>
How would one handle sysusers stuff in a way completely compatible with rpm-ostree?
<alebastr[m]>
To elaborate, `%sysusers_create_compat` modifies `/usr/etc/passwd` and `/usr/etc/group` and nss_altfiles can handle that. What does not happen though is merge of `/usr/etc/shadow` to `/etc/shadow`, so anything that relies on shadow db still thinks that the user is not there.
<alebastr[m]>
I'm suspecting that the solution would include 1. %sysusers_create_package, 2. making sure that nothing in the package itself is owned by a new user and creating all such dirs/files with tmpfiles. Do I miss something?
<dustymabe>
alebastr[m]: jlebon or travier[m] might know
<spresti[m]>
dustymabe: ty
<travier[m]>
alebastr: You need the application doing the look up to use the glibc nss that will then use nss-altfiles
<alebastr[m]>
travier[m]: The application is somewhere deep in the system stuff. It's something that screams to the journal "no such user in pam database: sddm" when the system starts. (I suspect logind)
<travier[m]>
alebastr: sddm is not in Fedora CoreOS 🙂
<alebastr[m]>
Is there a generic rpm-ostree support channel though? :)
<travier[m]>
As a workaround, you can create a sysusers entry that will add it to the files in /etc
<travier[m]>
The question is more: what are you trying to do and on which Fedora variant
<alebastr[m]>
The package already uses sysusers, and I saw that rpm-ostree supposed to intercept legacy useradd/groupadd scriptlets. But something doesn't work and the users are created in the /usr/etc (which promptly breaks sysusers processing on target system)
<jlebon>
i haven't looked at this in a while, and there were enhancements there recently-ish, but the status quo right now is that system accounts are added in /usr/lib/ and only user accounts live in /etc
<jlebon>
i think to help you debug this more, it'd be better to file an rpm-ostree issue with the pkg you're trying to install and the scriptlets it runs
<jlebon>
but one possible thing to verify is that the scriptlet is indeed trying to add a system user
<travier[m]>
alebastr: Know I remember why I should know you. You're working on the Sway variant right? We have a workaround in sddm related to users/group ids
<alebastr[m]>
I think `get rid of nss_altfiles` silverblue issue already contains more details that I can provide.
<alebastr[m]>
"but the status quo right now" - Ok, it seems like this should be fixed on the other side.
<alebastr[m]>
travier: the workaround is insufficient. If you rebase to a tree that adds sddm (as opposed to installing a system that has it from the beginning), it won't be added to /etc/shadow. Which causes issues with logind, and leads to not being able to start systemd user session for the system user
<travier[m]>
It should not be in /etc/shadow, only in /usr/lib/shadow if it's part of an ostree image
<alebastr[m]>
uh, I need a real system to grab the relevant logs, and it's at home. but anyways, I'll look at systemd side if we believe that unmerged /etc/shadow should be working
<travier[m]>
Hum, we don't have a /usr/lib/shadow, it's only in /usr/etc/shadow
<dustymabe>
spresti[m]: we probably need to copy in the selinux denial messages into the BZ
<dustymabe>
they should be in the journal I would assume
<dustymabe>
look for any AVC messages that have the string `denied` in them
<spresti[m]>
Ok, I will add those.
jpn has quit [Quit: Lost terminal]
frigo has quit [Quit: Client closed]
frigo has joined #fedora-coreos
frigo has quit [Ping timeout: 260 seconds]
frigo has joined #fedora-coreos
<alebastr[m]>
travier: actually, was it considered to update nss-altfiles to a newer version with shadow db support? I believe that would solve the problem