Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

nss-resolve: example nsswitch.conf renders myhostname unused #5742

Closed
foutrelis opened this issue Apr 15, 2017 · 5 comments
Closed

nss-resolve: example nsswitch.conf renders myhostname unused #5742

foutrelis opened this issue Apr 15, 2017 · 5 comments
Assignees
@keszybz
Labels
nss resolve
Milestone
v234

Comments

@foutrelis
Copy link
Contributor

foutrelis commented Apr 15, 2017 •
edited

Arch ships /etc/nsswitch.conf with the following hosts line:

hosts: files mymachines resolve [!UNAVAIL=return] dns myhostname

This seems to be in accordance with the example /etc/nsswitch.conf file found in nss-resolve(8).

My understanding is that dns is meant as a fallback for nss-resolve when the latter isn't found on the system. An unintended side-effect of this is that myhostname will not be used if nss-resolve exists, regardless of whether systemd-resolved is running.

The net effect is that I cannot ping localhost or my hostname. (Assuming systemd-resolved is not running.) This is bad because I like the idea behind myhostname and it would be great if it was used.

Maybe myhostname could be moved right before (or immediately after) mymachines?

I'm using systemd 233-3 with 8.8.8.8/8.8.4.4 as my nameservers in /etc/resolv.conf, systemd-resolved is disabled and not running, and my /etc/hosts file is empty.
@foutrelis
Copy link
Contributor Author

foutrelis commented Apr 15, 2017 •
edited

It also seems that !UNAVAIL is not sufficient to determine if nss-resolve managed to talk to resolved because it falls back to libnss_dns.so.2 which I'm guessing returns NOTFOUND for localhost (when using external nameservers).

@poettering
Copy link
Member

Hmm, but nss-resolve does return UNVAIL if it can't talk to resolved, hence the dns/myhostname fallback should be used in that case.

(But you are right, we should drop the internal dlopen() shortcut to libnss_dns, it makes no sense anymore)

@poettering
Copy link
Member

how precisely did you turn off resolved btw? mask it? disable it?

@poettering poettering added needs-reporter-feedback ❓ There's an unanswered question, the reporter needs to answer nss resolve labels Apr 24, 2017
@foutrelis
Copy link
Contributor Author

Hmm, but nss-resolve does return UNVAIL if it can't talk to resolved, hence the dns/myhostname fallback should be used in that case.

It would return UNAVAIL if the libnss_dns fallback didn't exist. I believe the latter returns NOTFOUND.

how precisely did you turn off resolved btw? mask it? disable it?

I don't remember doing anything special to disable it. I believe it's just not running by default on Arch.

@poettering poettering added this to the v234 milestone Apr 24, 2017
@foutrelis
Copy link
Contributor Author

I'm starting to understand why resolved is not enabled by default on Arch; the systemd PKGBUILD does the following in its package creation step:

  # don't write units to /etc by default. some of these will be re-enabled on
  # post_install.
  rm -r "$pkgdir/etc/systemd/system/"*.wants

The above removes the /etc/systemd/system/multi-user.target.wants/systemd-resolved.service symlink that systemd ships by default. Only /etc/systemd/system/dbus-org.freedesktop.resolve1.service remains in the package but that doesn't do anything.

I also noticed that systemd-resolved.service is defined as enabled in 90-systemd.preset but systemctl preset [..] isn't called during installation so all services remain disabled.

I can't say I mind resolved being disabled by default (it seems unnecessary for my purposes), but the above seems a bit confusing; in particular, the pointless (?) existence of /etc/systemd/system/dbus-org.freedesktop.resolve1.service and the presets which are not applied. Perhaps @falconindy could clarify things a bit further.

@keszybz keszybz removed the needs-reporter-feedback ❓ There's an unanswered question, the reporter needs to answer label May 11, 2017
@keszybz keszybz self-assigned this May 11, 2017
@keszybz keszybz added the has-pr label May 11, 2017
keszybz added a commit to keszybz/systemd that referenced this issue May 11, 2017
@keszybz
nss-resolve: drop the internal fallback to libnss_dns
a126e0c 
If we could not communicate with systemd-resolved, we would call into
libnss_dns. libnss_dns would return a fatal error for stuff like "localhost"
and other names resolved by nss-myhostname. So the following recommended
configuration in nsswitch.conf would not work:

   hosts: resolve [!UNAVAIL=return] myhostname

Remove the internal fallback code completely so that the fallback logic
can be configured in nsswitch.conf.

Tested with
   hosts: resolve [!UNAVAIL=return] myhostname
and
   hosts: resolve [!UNAVAIL=return] dns myhostname

Fixes systemd#5742.
keszybz added a commit to keszybz/systemd that referenced this issue May 11, 2017
@keszybz
nss-resolve: drop the internal fallback to libnss_dns
8a6cbcb 
If we could not communicate with systemd-resolved, we would call into
libnss_dns. libnss_dns would return NOTFOUND for stuff like "localhost" and
other names resolved by nss-myhostname, which we would fall under the !UNAVAIL=
condition and cause resolution to fail. So the following recommended
configuration in nsswitch.conf would not work:

   hosts: resolve [!UNAVAIL=return] dns myhostname

Remove the internal fallback code completely so that the fallback logic
can be configured in nsswitch.conf.

Tested with
   hosts: resolve [!UNAVAIL=return] myhostname
and
   hosts: resolve [!UNAVAIL=return] dns myhostname

Fixes systemd#5742.
keszybz added a commit to keszybz/systemd that referenced this issue May 12, 2017
@keszybz
nss-resolve: drop the internal fallback to libnss_dns
06583ab 
If we could not communicate with systemd-resolved, we would call into
libnss_dns. libnss_dns would return NOTFOUND for stuff like "localhost" and
other names resolved by nss-myhostname, which we would fall under the !UNAVAIL=
condition and cause resolution to fail. So the following recommended
configuration in nsswitch.conf would not work:

   hosts: resolve [!UNAVAIL=return] dns myhostname

Remove the internal fallback code completely so that the fallback logic
can be configured in nsswitch.conf.

Tested with
   hosts: resolve [!UNAVAIL=return] myhostname
and
   hosts: resolve [!UNAVAIL=return] dns myhostname

Fixes systemd#5742.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@keszybz keszybz

Labels
nss resolve
Milestone
v234
Development

No branches or pull requests
3 participants
@foutrelis @keszybz @poettering