From 6fdb4834cdb5557d9bd7562f61984da8bd0d9c80 Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Thu, 9 Sep 2021 19:58:12 +0000 Subject: Prepare for 0.2.0.0, lots of changes. - Make _r functions completely thread-safe. - Save a lot of forking by having a persistent nsss_switch_query - Introduce a timeout to make the server expire - Start writing nsss-switch, not working yet. Signed-off-by: Laurent Bercot --- doc/nsssd-switch.html | 105 ++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 105 insertions(+) create mode 100644 doc/nsssd-switch.html (limited to 'doc/nsssd-switch.html') diff --git a/doc/nsssd-switch.html b/doc/nsssd-switch.html new file mode 100644 index 0000000..9f5672c --- /dev/null +++ b/doc/nsssd-switch.html @@ -0,0 +1,105 @@ + + + + + + nsss: the nsssd-switch program + + + + + + +

+nsss
+Software
+skarnet.org +

+ +

The nsssd-switch program

+ +

+nsssd-switch is a daemon providing a backend for clients using the +nsss library - more precisely, clients using +the nsss-all or +the nsss-switch functions. +

+ +

+ The nsssd-switch backend is the real point of the nsss +package: it allows a complex configuration using different other backends, +similarly to the /etc/nsswitch.conf mechanism +but without its drawbacks. It accomplishes this by reading its backend +configuration on the command line. +

+ +

Interface

+ +
+     s6-ipcserver -l0 /run/service/nsssd/s nsssd-switch bitfield1 backend1... "" bitfield2 backend2... "" ...
+
+ +

+ or, in an execline script: +

+ +
+     s6-ipcserver -l0 /run/service/nsssd/s
+     nsssd-switch
+       bitfield1 { backend1... }
+       bitfield2 { backend2... }
+       ...
+
+ + + + +

Notes

+ +

+ nsssd-switch is not meant to be called directly; instead, it is expected to be run from +a script as a part of a "nsssd" +local service. +

+ +

+ The examples/ subdirectory of the nsss package provides examples +on how to run such a service. + The simplest way to do so, for testing purposes, is a command line such as: +

+
s6-ipcserver -l0 /run/service/nsssd/s nsssd-switch 0 nsssd-unix ""
+ +

+/run/service/nsssd/s is the default place where nsss's +implementation of the pwd.h, grp.h and shadow.h +functions expects the nsssd +service to be. It can be changed at nsss build time by giving the +--with-nsssd-socket=PATH option to configure. +

+ +

+ nsssd-switch does not listen to the socket itself: it reads from its +standard input and writes to its standard output. It relies +on a superserver such as +s6-ipcserver +to manage connections to the socket. An instance of nsssd-switch is run +for every client connection. +

+ +

+ If fine-grained authorizations are required (only allowing +certain users and groups to connect to the service), the superserver +can be configured to enforce them. +

+ +

+ nsssd-switch does not need to run as root, provided it has all the +permissions needed by the backends it spawns. +It is recommended to create a nsss user and group, dedicated to +the nsssd service, and run the superserver as this user and group. +

+ + + -- cgit v1.3.1