Use systemd-sysusers

[Mathnerd314]

Systemd 215 is released, and has a new way of configuring system user accounts which is much nicer than our current shell-script approach. Systemd should be updated to 215 and then the user/groups creation code changed to write to a systemd-sysusers configuration file.

[Mathnerd314]

Note that systemd-sysusers is limited to configuring password-less disabled-login users; so if /etc is readonly (#3192) we will need to use an alternate method of configuration for other (normal) users, e.g. https://github.com/aperezdc/nss-altfiles.

[wmertens]

How do you propose to handle passwords? Should the hash be stored in
world-readable files?

[Mathnerd314]

Systemd-sysusers doesn't let you specify passwords, so this issue doesn't handle them. Passworded users will be elsewhere, e.g. with altfiles they'll be in /var/lib/nss, with the typical world-readable passwd and root-readable shadow split, and you can handle those files and the passwords they contain any way you choose, either with Nix or by hand. Or you can use a bigger solution, e.g. sssd or LDAP.

[Profpatsch]

While using an “official” way to do declarative users would be nice, I believe our current scripts are quite mature by now.

Are there any good arguments for switching? My impressions are:

• It seems to be a quite small feature in systemd, how bug-free is it really?
• The manpage for sysusers.d doesn’t exist on my system
• Yet another thing that depends on systemd

@Mathnerd314, do you want to implement that? Otherwise it vote for close.

[joachifm]

I have used sysusers on non-NixOS setups, works as advertised in my experience. Whether it would bring anything to NixOS is unclear, apart from offloading some logic onto systemd (and thus also having to abide by their rules for how system users are to be handled).

[Mathnerd314]

The scripts are not what I would call "mature"; they are littered with "FIXME". That being said, systemd-sysusers cannot make ordinary users, so the perl script seems preferable at the moment.

[Profpatsch]

Maybe @edolstra is in favor of a rewrite?

[bb010g]

Support for systemd-sysusers has been implemented in #270727.