FS#44494 - [openssh] Please ship a tmpfiles.d snippet that makes sure /var/empty is available

Attached to Project: Arch Linux
Opened by Tobias Hunger (hunger) - Tuesday, 07 April 2015, 19:51 GMT
Last edited by Gaetan Bisson (vesath) - Wednesday, 08 April 2015, 17:57 GMT
Task Type Bug Report
Category Packages: Extra
Status Closed
Assigned To Gaetan Bisson (vesath)
Architecture All
Severity Low
Priority Normal
Reported Version
Due in Version Undecided
Due Date Undecided
Percent Complete 100%
Votes 0
Private No

Details

Description:

When playing with a stateless system sshd does not allow me to log in anymore. This is due to /var/empty not being created and thus privilege separation (default setting) does not work.

Could you please add a tmpfiles.d snippet that makes sure the directory is created if not present already? Thanks!

Additional info:
* openssh 6.8p1-2

Steps to reproduce:
* Have the rootfs be a tmpfs, mount /usr onto it.
* Try to log in via SSH.
This task depends upon

Closed by  Gaetan Bisson (vesath)
Wednesday, 08 April 2015, 17:57 GMT
Reason for closing:  Implemented
Additional comments about closing:  in SVN
Comment by Gaetan Bisson (vesath) - Tuesday, 07 April 2015, 21:14 GMT
$ pacman -Qo /var/empty/
/var/empty/ is owned by filesystem 2015.02-1
/var/empty/ is owned by openssh 6.8p1-2

Which means installing filesystem and/or openssh should give you that directory...
Comment by Gaetan Bisson (vesath) - Tuesday, 07 April 2015, 21:18 GMT
Ah, you only mount /usr. Well, packages do not merely consist in the files they put under /usr. Removing /var (or any other such directory) is unsupported. You should mount it too.
Comment by Doug Newgard (Scimmia) - Tuesday, 07 April 2015, 22:53 GMT
This is one of those things where you're on your own if you go away from the defaults.
Comment by Tobias Hunger (hunger) - Wednesday, 08 April 2015, 13:33 GMT
@Gaetan: It would not be a stateless system if /var was persistent. That is where a huge part of the state is after all:-) http://0pointer.de/blog/projects/stateless.html has some in-depth information on what I am doing.

@Doug: Reporting these little annoyances when straying away from the defaults is a public service more than anything else. I just added a tmpfiles.d snippet into /usr/lib/tmpfiles.d and am done with it.

Such a tmpfiles.d snippet does not hinder the default use case at all and enables some more exotic ones, so IMHO it is worth doing.

Loading...