NixOS / nixpkgs

Nix Packages collection & NixOS
MIT License
17.94k stars 13.96k forks source link

`users.users.<name>.autoSubUidGidRange = true` creates overlapping Ids for normal and system users #259588

Open ppenguin opened 1 year ago

ppenguin commented 1 year ago

Describe the bug

Setting users.users.<name>.autoSubUidGidRange = true for a few normal and a few system users creates overlapping Ids, where it appears that the "counter" starts at the beginning for the system and normal user category.

Steps To Reproduce

Steps to reproduce the behavior:

  1. Set users.users.<name>.autoSubUidGidRange = true for a few normal users
  2. Set users.users.<name>.autoSubUidGidRange = true for a few system users
  3. Observe overlapping IDs in /etc/sub*id

Expected behavior

ID ranges count linearly to avoid overlap, considering both system and normal users the same.

Screenshots

If applicable, add screenshots to help explain your problem.

Additional context

Add any other context about the problem here.

Notify maintainers

Metadata

Please run nix-shell -p nix-info --run "nix-info -m" and paste the result.

[user@system:~]$ nix-shell -p nix-info --run "nix-info -m"
nix-shell -p nix-info --run "nix-info -m"
 - system: `"x86_64-linux"`
 - host os: `Linux 6.5.5-zen1, NixOS, 23.11 (Tapir), 23.11.20231004.7131f3c`
 - multi-user?: `yes`
 - sandbox: `relaxed`
 - version: `nix-env (Nix) 2.17.0`
 - nixpkgs: `/nix/store/hcdnrkjkrm30lg62aakdiah076iwjxhl-9gzb6bb0ghi5njm63sghyl7ia47n1ncn-source`
ppenguin commented 1 year ago

I noticed that here (https://github.com/NixOS/nixpkgs/blob/81e8f48ebdecf07aab321182011b067aafc78896/nixos/modules/config/users-groups.nix#L355C27-L355C27) the default for normal users is to generate sub*ids if none are specified and not explicitly disabled, which is ok (most system users wouldn't need to run podman), but I coundn't find where the actual generation script resides...

WinstonHartnett commented 22 hours ago

Yep, ran into this too. The bit that updates user info is here by calling this perl script.