nixos/virtualisation: increase priority for libvirt NSS modules#322980
Merged
flokli merged 1 commit intoNixOS:masterfrom Jun 28, 2024
Merged
nixos/virtualisation: increase priority for libvirt NSS modules#322980flokli merged 1 commit intoNixOS:masterfrom
flokli merged 1 commit intoNixOS:masterfrom
Conversation
When `services.resolved` is enabled, then `resolve [!UNAVAIL=return]` is added to `system.nssDatabases.hosts` with priority 501, which prevents lower-priority NSS modules from running unless systemd-resolved is not available. Quoting from `man nss-resolve`: > To activate the NSS module, add "resolve [!UNAVAIL=return]" to the line > starting with "hosts:" in /etc/nsswitch.conf. Specifically, it is > recommended to place "resolve" early in /etc/nsswitch.conf's "hosts:" > line. It should be before the "files" entry, since systemd-resolved > supports /etc/hosts internally, but with caching. To the contrary, it > should be after "mymachines", to give hostnames given to local VMs and > containers precedence over names received over DNS. Finally, we > recommend placing "dns" somewhere after "resolve", to fall back to > nss-dns if systemd-resolved.service is not available. Note that the man page (just) recommends "early" and means with this "before the 'files' and 'dns' entries". It does not insist on being first or excluding other modules. For this reason, libvirt NSS modules should run before the `resolve` module. They should come right next to `mymachines` because both are conceptually very similar -- they resolve local VMs/containers. Since the data source of the libvirt NSS modules are local plain text files (see source code of the libvirt NSS module), no performance impact is expected form this raise of priorities. Other NSS modules in NixOS also explicitly set their priority, which is why this change increases consistency. Fixes NixOS#322022
jchv
approved these changes
Jun 28, 2024
Contributor
jchv
left a comment
There was a problem hiding this comment.
LGTM. Seems to work, of course, and seems to be closer to the general recommendation anyways. I ran the libvirtd test and it still passes as expected.
Member
|
Please include the test for the NSS lookup into the libvirt VM test, so we can make sure this doesn't regress unnoticed. |
Contributor
Member
|
Fair enough. Running two tests just to that is probably a bit overkill. I assume you'll notice once it regresses ;-) |
Contributor
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When
services.resolvedis enabled, thenresolve [!UNAVAIL=return]is added tosystem.nssDatabases.hostswith priority 501, which prevents lower-priority NSS modules from running unless systemd-resolved is not available.Quoting from
man nss-resolve:Note that the man page (just) recommends "early" and means with this "before the 'files' and 'dns' entries". It does not insist on being first or excluding other modules.
For this reason, libvirt NSS modules should run before the
resolvemodule. They should come right next tomymachinesbecause both are conceptually very similar -- they resolve local VMs/containers.Since the data source of the libvirt NSS modules are local plain text files (see source code of the libvirt NSS module), no performance impact is expected form this raise of priorities.
Other NSS modules in NixOS also explicitly set their priority, which is why this change increases consistency.
Fixes #322022
Description of changes
The NSS modules
libvirtandlibvirt_guestnow run even whenservices.resolvedis enabled.Things done
nix.conf? (See Nix manual)sandbox = relaxedsandbox = truenix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage./result/bin/)Add a 👍 reaction to pull requests you find important.