[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1055786: GID=1000 for netdev created by cloud-init violates Debian Policy



Package: cloud-init
Version: 22.4.2-1
Severity: normal

## Background:

The problem and possible root cause fix are reported on upstream github
issue: https://github.com/canonical/cloud-init/issues/4603

## Issue:
I noticed instance generated from Debian bookworm cloud image on
linuxcontainer.org had odd GID=1000 for netdev. Since netdev should be a
system group, this situation violates Debian policy.

Basically, cloud-init has a bug of creating system group starting from
GID=1000 if it sees some group name listed in groups-list and missing on
the system's /etc/group.

## What am I asking to Debian packagers

The root cause fix takes long time in upstream.  There should be some
least invasive workaround to avoid this issue on most use cases simply
by updating debian/cloud.cfg file.

I suggest to drop "netdev" from `debian/cloud.cfg` as the least invasive
minimal change.  This should be done on both on stable (now) and
unstable (unless upstream fixes the root cause).

## Technical consideration.

This debian/cloud.cfg is installed by override_dh_installinit target in
debian/rules .  I compaired this against upstream config/cloud.cfg.tmpl.
It looks like this has modified upstream generated cloud.cfg which
sharies its contents with Ubuntu.  I see "[Uu]buntu" swapped with
"[Dd]ebian" in cloud.cfg. Besides these cosmetic changes, Debian
packaging already made interesting change in it.  Let's look at groups
in cloud.cfg.

upstream: adm, audio, cdrom, dialout, dip, floppy, lxd, netdev, plugdev, sudo, video
debian:   adm, audio, cdrom, dialout, dip, floppy, netdev, plugdev, sudo, video

I don't know how these are chosen mostly for Ubuntu by upstream but
Debian packager made decision to drop "lxd" here.

Minimal Debian system has its system group defined in base-passwd
package.  So "adm, audio, cdrom, dialout, dip, floppy, plugdev, sudo,
video" are guranteed to exist. Debian package should drop not only "lxd"
but also "netdev".

I don't think removing `netdev` cause much problem.

As you know, `netdev` is for `/dev/wfkill` and wpsupplicant and similar
packages.  If anyone decides to add these packages to the root image, it
get generated properly by postinst.  Of course, adding `netdev` group to 
the primary user account `debian` is needed if the user wishes.  That's
something to be documented.  We must keep Debian system compliant to
Debian policy.

Debian Policy
https://www.debian.org/doc/debian-policy/ch-opersys.html#uid-and-gid-classes

  100-999:
  Dynamically allocated system users and groups. Packages which need a
  user or group, but can have this user or group allocated dynamically and
  differently on each system, should use adduser --system to create the
  group and/or user. adduser will check for the existence of the user or
  group, and if necessary choose an unused id based on the ranges
  specified in adduser.conf.


-- System Information:
Debian Release: 12.2
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.5.0-0.deb12.1-amd64 (SMP w/12 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages cloud-init depends on:
ii  eject                      2.38.1-5+b1
ii  fdisk                      2.38.1-5+b1
ii  gdisk                      1.0.9-2.1
ii  isc-dhcp-client            4.4.3-P1-2
ii  locales                    2.36-9+deb12u3
ii  lsb-base                   11.6
ii  lsb-release                12.0-1
ii  procps                     2:4.0.2-3
ii  python3                    3.11.2-1+b1
ii  python3-configobj          5.0.8-1
ii  python3-jinja2             3.1.2-1
ii  python3-jsonpatch          1.32-2
ii  python3-jsonschema         4.10.3-1
ii  python3-netifaces          0.11.0-2+b1
ii  python3-oauthlib           3.2.2-1
ii  python3-requests           2.28.1+dfsg-1
ii  python3-serial             3.5-1.1
ii  python3-yaml               6.0-3+b2
ii  sysvinit-utils [lsb-base]  3.06-4
ii  util-linux                 2.38.1-5+b1

Versions of packages cloud-init recommends:
ii  cloud-guest-utils  0.33-1
ii  eatmydata          130-2
ii  sudo               1.9.13p3-1+deb12u1

Versions of packages cloud-init suggests:
ii  btrfs-progs  6.2-1
ii  e2fsprogs    1.47.0-2
ii  xfsprogs     6.1.0-1

-- no debconf information


Reply to: