Arch Linux

Please read this before reporting a bug:
https://wiki.archlinux.org/title/Bug_reporting_guidelines

Do NOT report bugs when a package is just outdated, or it is in the AUR. Use the 'flag out of date' link on the package page, or the Mailing List.

REPEAT: Do NOT report bugs for outdated packages!
Tasklist

FS#40800 - [filesystem] pwck fails

Attached to Project: Arch Linux
Opened by Sven Karsten Greiner (SammysHP) - Wednesday, 11 June 2014, 17:33 GMT
Last edited by Dave Reisner (falconindy) - Saturday, 21 June 2014, 16:01 GMT
Task Type Bug Report
Category Packages: Core
Status Closed
Assigned To Dave Reisner (falconindy)
Architecture All
Severity Medium
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 2
Private No

Details

Description:
The service "shadow.service" fails with the following error:

Jun 11 18:53:53 thinkwolf systemd[1]: Starting Verify integrity of password and group files...
Jun 11 18:53:53 thinkwolf pwck[849]: Kein passender Passwortdatei-Eintrag in /etc/shadow
Jun 11 18:53:53 thinkwolf pwck[849]: Benutzer »systemd-journal-gateway« zu /etc/shadow hinzufügen? Nein
Jun 11 18:53:53 thinkwolf pwck[849]: Kein passender Passwortdatei-Eintrag in /etc/shadow
Jun 11 18:53:53 thinkwolf pwck[849]: Benutzer »systemd-timesync« zu /etc/shadow hinzufügen? Nein
Jun 11 18:53:53 thinkwolf pwck[849]: pwck: Keine Änderungen
Jun 11 18:53:53 thinkwolf systemd[1]: shadow.service: main process exited, code=exited, status=2/INVALIDARGUMENT
Jun 11 18:53:53 thinkwolf systemd[1]: Failed to start Verify integrity of password and group files.
Jun 11 18:53:53 thinkwolf systemd[1]: Unit shadow.service entered failed state.

(Sorry for German, my locale is de_DE. It basically says that /etc/shadow doesn't contain entries for systemd-journal-gateway and systemd-timesync.)


Additional info:
/etc/shadow contains only the entries from the package (plus the one for my user and some other packages):

root:************:16227::::::
bin:x:14871::::::
daemon:x:14871::::::
mail:x:14871::::::
ftp:x:14871::::::
http:x:14871::::::
uuidd:x:14871::::::
dbus:x:14871::::::
nobody:x:14871::::::
sammyshp:************:16227:0:99999:7:::
avahi:!:16227::::::
ntp:!:16227:0:99999:7:::
git:!:16227::::::
polkitd:!:16228:0:99999:7:::
mysql:!:16228:0:99999:7:::
kdm:!:16228::::::
systemd-network:!:16229:0:99999:7:::

I assume that is related to the post_upgrade() function in the .install file that hasn't updated the settings for these users.

[2014-06-06 14:19] [PACMAN] installed filesystem (2014.05-2)
[2014-06-08 20:54] [PACMAN] upgraded filesystem (2014.05-2 -> 2014.06-1)

As you can see, I installed Arch on 2014-06-06 and filesystem was upgraded two days later (that's why /etc/shadow contains an entry for systemd-network).

Another issue that might be related to this: My /etc/passwd still contains /bin/false instead of /usr/bin/nologin as the login shell.
This task depends upon

Closed by  Dave Reisner (falconindy)
Saturday, 21 June 2014, 16:01 GMT
Reason for closing:  Fixed
Comment by Dave Reisner (falconindy) - Wednesday, 11 June 2014, 17:49 GMT
Merge your pacnews, then, as you're supposed to. I've no idea why your post_upgrade failed.
Comment by Sven Karsten Greiner (SammysHP) - Wednesday, 11 June 2014, 17:56 GMT
But merging the pacnews helps only for /bin/false -> /usr/bin/nologin.

Here's an update for pwck and grpck:

# pwck -r
no matching password file entry in /etc/shadow
add user 'systemd-journal-gateway' in /etc/shadow? No
no matching password file entry in /etc/shadow
add user 'systemd-timesync' in /etc/shadow? No
pwck: no changes
# grpck -r
no matching group file entry in /etc/gshadow
add group 'systemd-journal-gateway' in /etc/gshadow? No
no matching group file entry in /etc/gshadow
add group 'systemd-timesync' in /etc/gshadow? No
grpck: no changes

post_upgrade() failed because of the getent check in _addgroup() and _adduser(): /etc/passwd and /etc/group already contained the user because it was included in the files from the package (2014.05-2). Thus groupadd and useradd were never called.

edit: No, that's not completely correct. In the packages passwd already contains the user, but shadow does not. getent returns the user, so nothing is changed. The grpconv-hack in post_upgrade() is not called because all other groups are in sync (especially lock). Also there is no pwconv call, so users can never be in sync between /etc/passwd and /etc/shadow.
Comment by Dave Reisner (falconindy) - Wednesday, 11 June 2014, 18:20 GMT
Ah, sure. I need to do another filesystem release anyways (thanks, systemd), so I'll ensure that grpconv and pwconv are run for the uberlazy if /etc/passwd or /etc/group are updated.
Comment by Sven Karsten Greiner (SammysHP) - Wednesday, 11 June 2014, 18:29 GMT
Well, the main issue is that passwd (in the package) contains three users that are not contained in shadow (in the package) and the same with group and gshadow. Running grpconv and pwconv always won't fix this issue for new installs of Arch because post_upgrade() won't be called.

edit: Meanwhile I merged the pacnew file for /etc/passwd and ran pwck and grpck to add missing entries in the shadow files.

To make it clear: This issue can only happen for a newly installed Arch as the shadow files from the package don't include all users/groups.
Comment by Dave Reisner (falconindy) - Wednesday, 11 June 2014, 23:34 GMT
filesystem 2014.06-2 should address all of this.
Comment by Sven Karsten Greiner (SammysHP) - Thursday, 12 June 2014, 10:07 GMT
IMHO need_group_update and need_passwd_update are unnecessary. useradd and groupadd automatically sync shadow and gshadow. This bug appeared only because the users/groups were in the stock passwd/group from the package but not in the corresponding (stock) shadow files. Thus useradd and group add were never run for theses users/groups.

I'd go one step further and would remove

# update shadow files if needed
if (( need_group_update )); then
grpconv >/dev/null
fi

if (( need_passwd_update )); then
pwconv >/dev/null
fi

completely as this situation should never happen (only if other packages modify /etc/passwd manually without useradd).

Loading...