From 4c2cf15751e7797452e0d7d2906b10fb2b46db3f Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Tue, 7 Jul 2020 21:29:21 +0200 Subject: [PATCH] man: document new varlink service --- docs/USER_GROUP_API.md | 6 +++- man/nss-systemd.xml | 50 ++++++++++++++++++++++++++++++-- man/systemd-machined.service.xml | 7 +++++ man/userdbctl.xml | 9 ++++++ 4 files changed, 68 insertions(+), 4 deletions(-) diff --git a/docs/USER_GROUP_API.md b/docs/USER_GROUP_API.md index 55f6af7d8e..ca88b3a16d 100644 --- a/docs/USER_GROUP_API.md +++ b/docs/USER_GROUP_API.md @@ -108,7 +108,7 @@ example, introspection is not available, and the resolver logic is not used. ## Other Services -The `systemd` project provides two other services implementing this +The `systemd` project provides three other services implementing this interface. Specifically: 1. `io.systemd.DynamicUser` → This service is implemented by the service @@ -119,6 +119,10 @@ interface. Specifically: and provides records for the users and groups defined by the home directories it manages. +3. `io.systemd.Machine` → This service is implemented by + `systemd-machined.service` and provides records for the users and groups used + by local containers that use user namespacing. + Other projects are invited to implement these services too. For example it would make sense for LDAP/ActiveDirectory projects to implement these interfaces, which would provide them a way to do per-user resource management diff --git a/man/nss-systemd.xml b/man/nss-systemd.xml index 26730f0fe9..ea293596be 100644 --- a/man/nss-systemd.xml +++ b/man/nss-systemd.xml @@ -35,8 +35,8 @@ systemd1 (for its DynamicUser= feature, see systemd.exec5 for - details) or - systemd-homed.service8. + details), + systemd-homed.service8, or systemd-machined.service8. This module also ensures that the root and nobody users and groups (i.e. the users/groups with the UIDs/GIDs 0 and 65534) remain resolvable at all times, even if they aren't listed in /etc/passwd or @@ -55,7 +55,7 @@ - Example + Configuration in <filename>/etc/nsswitch.conf</filename> Here is an example /etc/nsswitch.conf file that enables nss-systemd correctly: @@ -77,6 +77,47 @@ netgroup: nis + + Example: Mappings provided by <filename>systemd-machined.service</filename> + + The container rawhide is spawned using + systemd-nspawn1: + + + # systemd-nspawn -M rawhide --boot --network-veth --private-users=pick +Spawning container rawhide on /var/lib/machines/rawhide. +Selected user namespace base 20119552 and range 65536. +... + +$ machinectl --max-addresses=3 +MACHINE CLASS SERVICE OS VERSION ADDRESSES +rawhide container systemd-nspawn fedora 30 169.254.40.164 fe80::94aa:3aff:fe7b:d4b9 + +$ getent passwd vu-rawhide-0 vu-rawhide-81 +vu-rawhide-0:*:20119552:65534:vu-rawhide-0:/:/usr/sbin/nologin +vu-rawhide-81:*:20119633:65534:vu-rawhide-81:/:/usr/sbin/nologin + +$ getent group vg-rawhide-0 vg-rawhide-81 +vg-rawhide-0:*:20119552: +vg-rawhide-81:*:20119633: + +$ ps -o user:15,pid,tty,command -e|grep '^vu-rawhide' +vu-rawhide-0 692 ? /usr/lib/systemd/systemd +vu-rawhide-0 731 ? /usr/lib/systemd/systemd-journald +vu-rawhide-192 734 ? /usr/lib/systemd/systemd-networkd +vu-rawhide-193 738 ? /usr/lib/systemd/systemd-resolved +vu-rawhide-0 742 ? /usr/lib/systemd/systemd-logind +vu-rawhide-81 744 ? /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only +vu-rawhide-0 746 ? /usr/sbin/sshd -D ... +vu-rawhide-0 752 ? /usr/lib/systemd/systemd --user +vu-rawhide-0 753 ? (sd-pam) +vu-rawhide-0 1628 ? login -- zbyszek +vu-rawhide-1000 1630 ? /usr/lib/systemd/systemd --user +vu-rawhide-1000 1631 ? (sd-pam) +vu-rawhide-1000 1637 pts/8 -zsh + + + See Also @@ -85,6 +126,9 @@ netgroup: nis nss-resolve8, nss-myhostname8, nss-mymachines8, + systemd-userdbd.service8, + systemd-homed.service8, + systemd-machined.service8, nsswitch.conf5, getent1 diff --git a/man/systemd-machined.service.xml b/man/systemd-machined.service.xml index 5172f6511a..a976c606bd 100644 --- a/man/systemd-machined.service.xml +++ b/man/systemd-machined.service.xml @@ -116,6 +116,13 @@ systemd-importd.service8 is also available, which implements importing, exporting, and downloading of container and VM images. + + For each container registered with systemd-machined.service that employs user + namespacing, users/groups are synthesized for the used UIDs/GIDs. These are made available to the system + using the User/Group Record Lookup API via + Varlink, and thus may be resolved with + userdbctl1 or the + usual glibc NSS calls. diff --git a/man/userdbctl.xml b/man/userdbctl.xml index 777393ab75..9a69f33edb 100644 --- a/man/userdbctl.xml +++ b/man/userdbctl.xml @@ -186,6 +186,15 @@ available to the system. + + io.systemd.Machine + + This service is provided by + systemd-machined.service8 + and synthesizes records for all users/groups used by a container that employs user + namespacing. + + io.systemd.Multiplexer