From 6fdb4834cdb5557d9bd7562f61984da8bd0d9c80 Mon Sep 17 00:00:00 2001 From: Laurent Bercot Date: Thu, 9 Sep 2021 19:58:12 +0000 Subject: Prepare for 0.2.0.0, lots of changes. - Make _r functions completely thread-safe. - Save a lot of forking by having a persistent nsss_switch_query - Introduce a timeout to make the server expire - Start writing nsss-switch, not working yet. Signed-off-by: Laurent Bercot --- doc/index.html | 3 +- doc/libnsssd/index.html | 8 ++-- doc/nsssd-switch.html | 105 ++++++++++++++++++++++++++++++++++++++++++++++++ doc/upgrade.html | 3 +- 4 files changed, 113 insertions(+), 6 deletions(-) create mode 100644 doc/nsssd-switch.html (limited to 'doc') diff --git a/doc/index.html b/doc/index.html index 6af20c4..c774b03 100644 --- a/doc/index.html +++ b/doc/index.html @@ -100,7 +100,7 @@ for s6-ipcserver).

Download

@@ -74,10 +74,10 @@ backend; the pointer to your handle will be passed to every subsequent function. The function must not return NULL.

-

int nsssd_handle_start (void *handle, char const *const *argv, char const *const *envp)

+

int nsssd_handle_start (void *handle, char const *const *argv)

This function must initialize the handle. The arguments -it receives are the argv and envp that have been +it takes are a pointer to the handle and the argv that has been passed to nsssd_main(). This allows you to write daemons that can be somewhat configured via the command line: it is how nsssd-nslcd takes an argument diff --git a/doc/nsssd-switch.html b/doc/nsssd-switch.html new file mode 100644 index 0000000..9f5672c --- /dev/null +++ b/doc/nsssd-switch.html @@ -0,0 +1,105 @@ + + + + + + nsss: the nsssd-switch program + + + + + + +

+nsss
+Software
+skarnet.org +

+ +

The nsssd-switch program

+ +

+nsssd-switch is a daemon providing a backend for clients using the +nsss library - more precisely, clients using +the nsss-all or +the nsss-switch functions. +

+ +

+ The nsssd-switch backend is the real point of the nsss +package: it allows a complex configuration using different other backends, +similarly to the /etc/nsswitch.conf mechanism +but without its drawbacks. It accomplishes this by reading its backend +configuration on the command line. +

+ +

Interface

+ +
+     s6-ipcserver -l0 /run/service/nsssd/s nsssd-switch bitfield1 backend1... "" bitfield2 backend2... "" ...
+
+ +

+ or, in an execline script: +

+ +
+     s6-ipcserver -l0 /run/service/nsssd/s
+     nsssd-switch
+       bitfield1 { backend1... }
+       bitfield2 { backend2... }
+       ...
+
+ + + + +

Notes

+ +

+ nsssd-switch is not meant to be called directly; instead, it is expected to be run from +a script as a part of a "nsssd" +local service. +

+ +

+ The examples/ subdirectory of the nsss package provides examples +on how to run such a service. + The simplest way to do so, for testing purposes, is a command line such as: +

+
s6-ipcserver -l0 /run/service/nsssd/s nsssd-switch 0 nsssd-unix ""
+ +

+/run/service/nsssd/s is the default place where nsss's +implementation of the pwd.h, grp.h and shadow.h +functions expects the nsssd +service to be. It can be changed at nsss build time by giving the +--with-nsssd-socket=PATH option to configure. +

+ +

+ nsssd-switch does not listen to the socket itself: it reads from its +standard input and writes to its standard output. It relies +on a superserver such as +s6-ipcserver +to manage connections to the socket. An instance of nsssd-switch is run +for every client connection. +

+ +

+ If fine-grained authorizations are required (only allowing +certain users and groups to connect to the service), the superserver +can be configured to enforce them. +

+ +

+ nsssd-switch does not need to run as root, provided it has all the +permissions needed by the backends it spawns. +It is recommended to create a nsss user and group, dedicated to +the nsssd service, and run the superserver as this user and group. +

+ + + diff --git a/doc/upgrade.html b/doc/upgrade.html index fa22bcb..d580203 100644 --- a/doc/upgrade.html +++ b/doc/upgrade.html @@ -18,13 +18,14 @@

What has changed in nsss

-

In 0.1.0.2

+

In 0.2.0.0

In 0.1.0.1

-- cgit v1.3.1