Hi Marc, On Mi 09 Sep 2026 18:45:48 CEST, Marc Haber wrote:
Hi Mike, On Tue, Sep 08, 2026 at 09:16:14PM +0000, Mike Gabriel wrote:* you add a debian/sudo.nss file into the sudo src:pkg with the following content:``` sudoers database-add sudoers first files ```Shouldn't src:sudo's libsss-sudo.deb deliver that file, and to where?
I, in fact, tried something like this in d/libsss-sudo.nss:
```
sudoers database-add
sudoers first files
sudoers last sss
```
And it nearly worked:
CASE-1: OK
* no sudoers: key in nsswitch.conf
-> result (on install): sudoers: files sss (correct)
-> result (after removal): no sudoers: key anymore (correct)
CASE-2: FLAWED
* `sudoers: files` in nsswitch.conf
-> result (on install): `sudoers: files` (so unchanged, wrong!)
-> result (on removal): no sudoers: key anymore (also wrong)
CASE-3: FLAWED
* `sudoers: files ldap` in nsswitch.conf
-> result (on install): `sudoers: files ldap` (wrong, should be:
files ldap sss)
-> result (on removal): `sudoers: ldap` (also wrong, should be:
files ldap)
* etc.
What do you think? If I have to fix #1129522 only from within libsss-sudo, it gets really hacky and I'd like to avoid that.I am planning to do an experimental upload of sudo soonish, so we can actually try that. I'd like to hear the oder sudo team members' opinion first, though.
Great!!!
In the long run, Debian should have a package like nss-helper that can own the nss files and provide programmatic interfaces to them. This should be discussed on debian-devel.
Indeed. Though, not as high a prio for me as the solving the current situation.
But of course we need a quickfix for this because of sssd.
That'd be great. Thanks! Mike -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 1976 148 landline: +49 (4351) 486 14 27 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: [email protected], http://sunweavers.net
pgpTweKU4CNE0.pgp
Description: Digitale PGP-Signatur
