On 6/22/23 19:55, Steve Grubb wrote:
https://fedoraproject.org/wiki/Changes/Adopting_sysusers.d_format
I would caution against this whole proposal. Not that I'm against it, but just saying be careful doing it. People often forget about our security concerns. Currently, shadow-utils has about 400 places which generate audit events during the managing of system and user accounts. libuser (I saw the deprecation email) has 55 places where it sends audit events managing accounts.
There is a 10 year old (or more) standard published here: https://github.com/linux-audit/audit-documentation/wiki/SPEC-User-Account-Li...
If %pre getent, useradd, and groupadd are being replaced by something, that something needs to conform to the expected security safeguards that currently exist. It needs to match the kind of events and the format that currently exists.
Looking at the systemd-sysusers source [1], it seems to do exactly zero audit logging. So there's a bit of work to do on that front...
- Panu -
[1] https://github.com/systemd/systemd/blob/main/src/sysusers/sysusers.c