Use glibc nss-based user and group lookups

[jmmk]

Describe the feature:

This is based on encountering the issue described in #482. I want to add some additional information and see if it is worth reconsidering.

Currently (as far as I can tell), the user and group check are done using https://github.com/opencontainers/runc/blob/master/libcontainer/user/user.go. This simply parses /etc/group and /etc/passwd.

However, on a Linux system using glibc, user and group checks will generally use nss, which can delegate to one or more "databases", such as the /etc/group file or a remote LDAP server.

Describe the solution you'd like

The os/user package, when cgo is enabled, will do the lookups using the libc functions (which should correctly use nss).

For most Unix systems, this package has two internal implementations of resolving user and group ids to names. One is written in pure Go and parses /etc/passwd and /etc/group. The other is cgo-based and relies on the standard C library (libc) routines such as getpwuid_r and getgrnam_r.

When cgo is available, cgo-based (libc-backed) code is used by default. This can be overridden by using osusergo build tag, which enforces the pure Go implementation.

One potential downside is the requirement of cgo. I see in https://github.com/aelsabbahy/goss/blob/master/release-build.sh that CGO_ENABLED=0. Building on Linux for Linux should be possible assuming the system has glibc, but it could complicate cross-compilation and probably is not compatible with Alpine or other musl libc systems without some extra work.

Two questions:

• Should goss use os/user instead of https://github.com/opencontainers/runc/blob/master/libcontainer/user/user.go?
• If the checks used os/user, would it then be possible to generate a build (at least a secondary build if not the primary build) with cgo enabled?

Describe alternatives you've considered

The easiest workaround is to use command instead of user and group. It's a functional alternative, but not ideal.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.