Bug#1055786: GID=1000 for netdev created by cloud-init violates Debian Policy
Package: cloud-init
Version: 22.4.2-1
Severity: normal
## Background:
The problem and possible root cause fix are reported on upstream github
issue: https://github.com/canonical/cloud-init/issues/4603
## Issue:
I noticed instance generated from Debian bookworm cloud image on
linuxcontainer.org had odd GID=1000 for netdev. Since netdev should be a
system group, this situation violates Debian policy.
Basically, cloud-init has a bug of creating system group starting from
GID=1000 if it sees some group name listed in groups-list and missing on
the system's /etc/group.
## What am I asking to Debian packagers
The root cause fix takes long time in upstream. There should be some
least invasive workaround to avoid this issue on most use cases simply
by updating debian/cloud.cfg file.
I suggest to drop "netdev" from `debian/cloud.cfg` as the least invasive
minimal change. This should be done on both on stable (now) and
unstable (unless upstream fixes the root cause).
## Technical consideration.
This debian/cloud.cfg is installed by override_dh_installinit target in
debian/rules . I compaired this against upstream config/cloud.cfg.tmpl.
It looks like this has modified upstream generated cloud.cfg which
sharies its contents with Ubuntu. I see "[Uu]buntu" swapped with
"[Dd]ebian" in cloud.cfg. Besides these cosmetic changes, Debian
packaging already made interesting change in it. Let's look at groups
in cloud.cfg.
upstream: adm, audio, cdrom, dialout, dip, floppy, lxd, netdev, plugdev, sudo, video
debian: adm, audio, cdrom, dialout, dip, floppy, netdev, plugdev, sudo, video
I don't know how these are chosen mostly for Ubuntu by upstream but
Debian packager made decision to drop "lxd" here.
Minimal Debian system has its system group defined in base-passwd
package. So "adm, audio, cdrom, dialout, dip, floppy, plugdev, sudo,
video" are guranteed to exist. Debian package should drop not only "lxd"
but also "netdev".
I don't think removing `netdev` cause much problem.
As you know, `netdev` is for `/dev/wfkill` and wpsupplicant and similar
packages. If anyone decides to add these packages to the root image, it
get generated properly by postinst. Of course, adding `netdev` group to
the primary user account `debian` is needed if the user wishes. That's
something to be documented. We must keep Debian system compliant to
Debian policy.
Debian Policy
https://www.debian.org/doc/debian-policy/ch-opersys.html#uid-and-gid-classes
100-999:
Dynamically allocated system users and groups. Packages which need a
user or group, but can have this user or group allocated dynamically and
differently on each system, should use adduser --system to create the
group and/or user. adduser will check for the existence of the user or
group, and if necessary choose an unused id based on the ranges
specified in adduser.conf.
-- System Information:
Debian Release: 12.2
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)
Kernel: Linux 6.5.0-0.deb12.1-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages cloud-init depends on:
ii eject 2.38.1-5+b1
ii fdisk 2.38.1-5+b1
ii gdisk 1.0.9-2.1
ii isc-dhcp-client 4.4.3-P1-2
ii locales 2.36-9+deb12u3
ii lsb-base 11.6
ii lsb-release 12.0-1
ii procps 2:4.0.2-3
ii python3 3.11.2-1+b1
ii python3-configobj 5.0.8-1
ii python3-jinja2 3.1.2-1
ii python3-jsonpatch 1.32-2
ii python3-jsonschema 4.10.3-1
ii python3-netifaces 0.11.0-2+b1
ii python3-oauthlib 3.2.2-1
ii python3-requests 2.28.1+dfsg-1
ii python3-serial 3.5-1.1
ii python3-yaml 6.0-3+b2
ii sysvinit-utils [lsb-base] 3.06-4
ii util-linux 2.38.1-5+b1
Versions of packages cloud-init recommends:
ii cloud-guest-utils 0.33-1
ii eatmydata 130-2
ii sudo 1.9.13p3-1+deb12u1
Versions of packages cloud-init suggests:
ii btrfs-progs 6.2-1
ii e2fsprogs 1.47.0-2
ii xfsprogs 6.1.0-1
-- no debconf information
Reply to: