Change: Authselect: Hardcode nss-altfiles in profiles

amoloney commented

2026-07-28 15:47:34 +00:00

Owner

Currently, authselect users can enable nss-altfiles in nsswitch.conf using "with-altfiles" feature. This proposal is to remove the feature and hardcode nss-altfiles support in nsswitch.conf in all shipped profiles, making it required.

Owners, do not implement this work until the FESCo vote has explicitly ended.
When a FESCo member has marked this ticket as APPROVED, you may proceed with the implementation. See the FESCo ticket policy and the Changes policy for more information.
If no decision has been rendered after 7 days from the filing of this ticket and no indication (such as a -1 vote) that this will be taken up at a FESCo meeting, please feel free to ping for a status update.

REMINDER: This ticket is for FESCo members to vote on the proposal. Further discussion should happen in the Discourse discussion linked above. Additional discussion may happen on the Fedora Devel mailing list.

Currently, authselect users can enable nss-altfiles in nsswitch.conf using "with-altfiles" feature. This proposal is to remove the feature and hardcode nss-altfiles support in nsswitch.conf in all shipped profiles, making it required. * [Change proposal](https://fedoraproject.org/wiki/Changes/Enable_nss-altfiles_for_all_installations) * [devel post](https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/SKM5W6V5PVA7KZOKGDNZPIHB3HAGYEOS/) * [Discourse discussion](https://discussion.fedoraproject.org/t/f45-change-proposal-authselect-hardcode-nss-altfiles-in-profiles-self-contained/197236) * Owners: @pbrezina **Owners, do not implement this work until the FESCo vote has explicitly ended.** When a FESCo member has marked this ticket as APPROVED, you may proceed with the implementation. See the [FESCo ticket policy](https://docs.fedoraproject.org/en-US/fesco/#_ticket_policy) and the [Changes policy](https://docs.fedoraproject.org/en-US/program_management/changes_policy/) for more information. If no decision has been rendered after 7 days from the filing of this ticket and no indication (such as a -1 vote) that this will be taken up at a FESCo meeting, please feel free to ping for a status update. **REMINDER**: This ticket is for FESCo members to vote on the proposal. Further discussion should happen in the Discourse discussion linked above. Additional discussion may happen on the [Fedora Devel](https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/) mailing list.

amoloney added this to the Fedora Linux 45 milestone

2026-07-28 15:47:34 +00:00

amoloney added the

self contained change

label

2026-07-28 15:47:34 +00:00

amoloney commented

2026-07-28 15:47:49 +00:00

Author

Owner

cc @pbrezina

decathorpe added the

vote-in-progress

label

2026-07-28 16:05:48 +00:00

siosm commented

2026-07-30 07:06:03 +00:00

Owner

The links here are pointing to another change.

siosm commented

2026-07-30 07:07:10 +00:00

Owner

Summary is also incorrect

siosm commented

2026-07-30 07:08:54 +00:00

Owner

Updated

siosm commented

2026-07-30 07:13:30 +00:00

Owner

I'm -1. There are no benefits listed for non-Atomic installations in the change request and we know that we have a lot of problems related to nss-altfiles in Atomic ones:

We haven't moved away from using nss-altfiles yet because it requires work to migrate existing systems and things "mostly" work for now and the problems are known (UID/GID drifts, etc.).

But this is really high on my TODO list.

I'm -1. There are no benefits listed for non-Atomic installations in the change request and we know that we have a lot of problems related to nss-altfiles in Atomic ones: - https://forge.fedoraproject.org/atomic-desktops/tracker/issues/108 - https://forge.fedoraproject.org/atomic/tracker/issues/87 We haven't moved away from using nss-altfiles yet because it requires work to migrate existing systems and things "mostly" work for now and the problems are known (UID/GID drifts, etc.). But this is really high on my TODO list.

siosm commented

2026-07-30 07:20:20 +00:00

Owner

High level summary of the issues with nss-altfiles:

The user/group manipulation tools do not understand it. If you have a group defined in a file read from nss-altfiles, you need workarounds to add a user to it: https://docs.fedoraproject.org/en-US/atomic-desktops/troubleshooting/#_unable_to_add_user_to_group
The shadow/gshadow tools also do not understand it. If you add a group to the nss-altfile config, it does not get added to gshadow, causing all sorts of issues: https://github.com/bootc-dev/bootc/issues/1179 / kde/tracker#684
Any user/group manipulation/usage will require going through nss otherwise those user/groups are invisible. This notably means that running tools from another rootfs without nss-altfiles enabled may duplicate / mess up the confguration.

Issues specific to building bootable container images:

High level summary of the issues with nss-altfiles: - The user/group manipulation tools do not understand it. If you have a group defined in a file read from nss-altfiles, you need workarounds to add a user to it: https://docs.fedoraproject.org/en-US/atomic-desktops/troubleshooting/#_unable_to_add_user_to_group - The shadow/gshadow tools also do not understand it. If you add a group to the nss-altfile config, it does not get added to gshadow, causing all sorts of issues: https://github.com/bootc-dev/bootc/issues/1179 / https://forge.fedoraproject.org/kde/tracker/issues/684 - Any user/group manipulation/usage will require going through nss otherwise those user/groups are invisible. This notably means that running tools from another rootfs without nss-altfiles enabled may duplicate / mess up the confguration. Issues specific to building bootable container images: - https://bootc.dev/bootc/building/users-and-groups.html#uidgid-drift - Example workaround that is needed: - https://github.com/openshift/os/pull/1918 - https://github.com/coreos/rhel-coreos-config/pull/224 - https://docs.fedoraproject.org/en-US/bootc/building-containers/#_invoking_useradd_as_part_of_a_container_build

decathorpe commented

2026-07-30 09:00:21 +00:00

Owner

Thanks, that is very helpful context. I wonder if, given the list of known affected tooling whether this should be classified as "system-wide" instead ...

Either way, the -1 vote puts this on the agenda for next week's meeting, so we'll have some chance to discuss this.

Thanks, that is very helpful context. I wonder if, given the list of known affected tooling whether this should be classified as "system-wide" instead ... Either way, the -1 vote puts this on the agenda for next week's meeting, so we'll have some chance to discuss this.

decathorpe added the

meeting

label

2026-07-30 09:00:27 +00:00

pbrezina commented

2026-08-04 09:37:03 +00:00

Hi, I'm commenting as the author of the change. I am fine to wait until nss-altfiles requirement is removed from atomic images - that would be the ideal and preferred solution. However, I would like to see a concrete timeline, not promises or wishful thinking since this is on the table for at least since Fedora 27 ~9 years. If I see that this becomes a priority, I am happy to revoke the change.

decathorpe commented

2026-08-04 14:36:44 +00:00

Owner

This topic is on the agenda for today's meeting:
https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/PWMQRM2RQXWIGSQQPX643JE3ADM5Y3AC/

This topic is on the agenda for today's meeting: <https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/PWMQRM2RQXWIGSQQPX643JE3ADM5Y3AC/>

ngompa commented

2026-08-04 14:42:22 +00:00

Owner

I'm -1 on this as well.

decathorpe commented

2026-08-04 18:12:42 +00:00

Owner

This was discussed during today's meeting. The Change proposal is REJECTED (+6, 0, -0) (meeting log starting at 17:06:48).

!info FESCo would like to see a resolution to this longstanding problem area and encourages the relevant parties (CoreOS, Atomic, bootc initiative, authselect maintainers) to collaborate.

Maybe @nimbinatus can help get things unstuck here as Bootc Initiative lead?

This was discussed during today's meeting. The Change proposal is REJECTED (+6, 0, -0) ([meeting log](https://meetbot.fedoraproject.org/meeting_matrix_fedoraproject-org/2026-08-04/fesco.2026-08-04-17.00.log.html) starting at 17:06:48). !info FESCo would like to see a resolution to this longstanding problem area and encourages the relevant parties (CoreOS, Atomic, bootc initiative, authselect maintainers) to collaborate. Maybe @nimbinatus can help get things unstuck here as Bootc Initiative lead?

👀 1

decathorpe added

and removed

labels

2026-08-04 18:12:55 +00:00