Re: Bullseye - who and users return nothing
On Tue 25 Jan 2022, at 13:11, Greg Wooledge <greg@wooledge.org> wrote:
> On Tue, Jan 25, 2022 at 01:06:42PM +0000, Gareth Evans wrote:
>> Just realised I gave contradicting info earlier - I said both that I upgraded from Buster (which is literally true) and that
>>
>> "But for root on ZFS per
>>
>> https://openzfs.github.io/openzfs-docs/Getting%20Started/Debian/Debian%20Buster%20Root%20on%20ZFS.html (adjusted for Bullseye) <<<<<<
>>
>> ..."
>>
>> which isn't, because Bullseye arrived via dist-upgrade, rather than a fresh installation.
>>
>> My mistake may have prompted Andrei's suggestion which I then explained away partly in relation to having upgraded - sorry.
>
> I don't know anything about ZFS. That said, it's *conceivable* that
> your / ownership has been broken this entire time, and you never noticed
> until now. Either because you never ran "who", or because
> systemd in
> buster didn't check the parent directory ownerships, but the one in
> bullseye does.
That's interesting.
FWIW, trying to get a timeframe...
My email re bullseye upgrade hiccups back in August
https://lists.debian.org/debian-user/2021/08/msg00979.html
indicates that I upgraded to Bullseye on 17th Aug 2021. There were at most a few days of experimenting with restoring Buster snapshots and re-upgrading, but that was certainly done with by October, when QEMU logs show VM usage.
I've never had to
modprobe tun
to start a VM before today, and Bash history shows who usage on 22/12/21. Given this info and that the / ownership fix fixed both problems, I think that suggests a recent(ish) event as the cause.
>
> Food for thought.
>
> (It's not clear to me how setting up ZFS on / would involve your
> unprivileged username, though. Sounds more like a "boot from rescue
> media and do everything in a root shell" sort of job.
It is, but...
"5. Create a user account:
username=YOUR_USERNAME
zfs create rpool/home/$username
adduser $username
cp -a /etc/skel/. /home/$username
chown -R $username:$username /home/$username
..."
https://openzfs.github.io/openzfs-docs/Getting%20Started/Debian/Debian%20Buster%20Root%20on%20ZFS.html
:)
> So I'm more
> inclined to think the damage was done by some sort of backup/recovery
> gone wrong, as previously speculated.)
Reply to: