Hi Marc, On Mi 09 Sep 2026 20:01:37 CEST, Marc Haber wrote:
Hi Mike,I wasn't aware of dh_installnss. Ignore the questions in my previous mails that could be answered by man dh_installnss.On Wed, Sep 09, 2026 at 05:46:25PM +0000, Mike Gabriel wrote:I, in fact, tried something like this in d/libsss-sudo.nss: ``` sudoers database-add sudoers first files sudoers last sss ``` And it nearly worked: CASE-1: OK * no sudoers: key in nsswitch.conf -> result (on install): sudoers: files sss (correct) -> result (after removal): no sudoers: key anymore (correct) CASE-2: FLAWED * `sudoers: files` in nsswitch.conf -> result (on install): `sudoers: files` (so unchanged, wrong!)Why is that wrong?
After apt-get install libsss-sudo I need it to be: `sudoers: files sss`, not `sudoers: files`.
The point is, that dh_installnss cannot handle adding two nss providers in one .nss file gracefully.
-> result (on removal): no sudoers: key anymore (also wrong)Why is that wrong?
If I start with `sudoers: files`, removing libsss-sudo should get me back to that. But it removes the complete sudoers: key (note, again with the above .nss config for libsss-sudo).
CASE-3: FLAWED * `sudoers: files ldap` in nsswitch.conf-> result (on install): `sudoers: files ldap` (wrong, should be: files ldap sss) -> result (on removal): `sudoers: ldap` (also wrong, should be: files ldap)I understand why that is flawed. And putting that in sudo.nss package does it right?
Yes, I assume it will. (I must admit, it is a theory, but I can test that).
In the long run, Debian should have a package like nss-helper that can own the nss files and provide programmatic interfaces to them. This should be discussed on debian-devel.Indeed. Though, not as high a prio for me as the solving the current situation.I just mailed a proposed specification.
Ack. Mike -- mike gabriel aka sunweaver (Debian Developer) mobile: +49 (1520) 1976 148 landline: +49 (4351) 486 14 27 GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31 mail: [email protected], http://sunweavers.net
pgpNulRwTLARn.pgp
Description: Digitale PGP-Signatur
