https://github.com/ostreedev/ostree/blob/16cb47489e582da9c139fee20acdac7079867843/docs/atomic-upgrad

https://github.com/ostreedev/ostree/blob/16cb47489e582da9c139fee20acdac7079867843/docs/atomic-upgrades.md?plain=1#L76

GitHub

ostree/atomic-upgrades.md at 16cb47489e582da9c139fee20acdac70798678...

Operating system and container binary deployment and upgrades - ostree/atomic-upgrades.md at 16cb47489e582da9c139fee20acdac7079867843 · ostreedev/ostree

Ppythoner6 https://github.com/ostreedev/ostree/blob/16cb47489e582da9c139fee20acdac707986784...

Arcitec•5/14/23, 2:37 AM

But read this from the OSTree website:

When OSTree creates a deployment, it performs a 3-way merge using the old default configuration, the active system’s /etc, and the new default configuration. In the final filesystem tree for a deployment then, /etc is a regular writable directory.

pythoner6OP•5/14/23, 2:37 AM

How it works is:
Files in the currently booted deployment's
/etc
/etc
which were modified from the default
/usr/etc
/usr/etc
(of the same deployment) are retained.
Files in the currently booted deployment's
/etc
/etc
which were not modified from the default
/usr/etc
/usr/etc
(of the same deployment) are upgraded to the new defaults from the new deployment's
/usr/etc
/usr/etc
.

Arcitec•5/14/23, 2:38 AM

Why does their own website contradict the part you just quoted?

pythoner6OP•5/14/23, 2:39 AM

I don't think it's a contradiction do much as ambiguous use of the term "merge"

Arcitec•5/14/23, 2:39 AM

Yeah it could just be poorly explained. Grr.

pythoner6OP•5/14/23, 2:39 AM

Individual files aren't being merged, but the entire /etc tree is being merged in a very coarse grained way

Arcitec•5/14/23, 2:40 AM

Oh yeah that makes sense. What a poor way to phrase that on their site. I've always thought it did a 3-way merge per-file, not directory-wise.

Arcitec•5/14/23, 2:40 AM

I've never even thought of directory comparisons as "3-way merging".

pythoner6OP•5/14/23, 2:41 AM

Yeah it's definitely not the best way to explain it without a bit more detail

Arcitec•5/14/23, 2:41 AM

Yeah, thanks for finding that, it's very useful to know. That changes how I'll maintain my system. I will run the "config diff" more often to resolve actual changes.

pythoner6OP•5/14/23, 2:42 AM

It's probably just a case of the people writing the docs being familiar enough with how it works that the explanation seems obvious enough - even though it's a bit unclear without the extra detail to someone not as familiar.

Arcitec•5/14/23, 2:43 AM

Yeah it's a common curse when trying to document a complex system that you're very familiar with.

pythoner6OP•5/14/23, 2:43 AM

Yeah my plan is to try to avoid touching things in /etc at all where possible

AArcitec Yeah, thanks for finding that, it's very useful to know. That changes how I'll m...

akdev•5/14/23, 2:43 AM

it'd be cool to have a script that does this and notifies

Arcitec•5/14/23, 2:43 AM

Yep, one thing I always do is edit the wireplumber config to add a script that disables audio device sleeping, to avoid that silent "popping" whenever audio begins playing again. I am doing it via some big edits.

I've been meaning to look for a way to install that in a more granular way that doesn't need maintenance constantly whenever wireplumber changes config.

Aakdev it'd be cool to have a script that does this and notifies

Arcitec•5/14/23, 2:44 AM

Yeah good idea, some kinda GUI that runs as autostart on login and pops up if there's changes.

dreams

pythoner6OP•5/14/23, 2:44 AM

Yeah I think having some kind of automated check that can keep tabs on the diff to prevent drift would be interesting

akdev•5/14/23, 2:44 AM

you don't really need a gui, just run the command if there are changes send a dbus notification

pythoner6OP•5/14/23, 2:44 AM

A bit complicated because there's a bunch of things that are probably going to be changed just by installing though, like /etc/passwd

Aakdev you don't really need a gui, just run the command if there are changes send a db...

Arcitec•5/14/23, 2:44 AM

Great idea

Ppythoner6 A bit complicated because there's a bunch of things that are probably going to b...

akdev•5/14/23, 2:45 AM

I wish anaconda put this stuff in /usr/etc before commiting the deployment to disk...

pythoner6OP•5/14/23, 2:46 AM

Eh but then should you be ending up with a new ostree deployment every time you change your password?

Arcitec•5/14/23, 2:47 AM

I don't think it compares those files, like

shadow

shadow

and

passwd

passwd

. That would be bad.

pythoner6OP•5/14/23, 2:48 AM

$ sudo ostree admin config-diff
M    adjtime
M    group
M    passwd
M    gshadow
M    shadow
M    machine-id
M    subgid
M    subuid
...

$ sudo ostree admin config-diff
M    adjtime
M    group
M    passwd
M    gshadow
M    shadow
M    machine-id
M    subgid
M    subuid
...

Arcitec•5/14/23, 2:48 AM

W!!@ADD

Arcitec•5/14/23, 2:48 AM

That's dumb.

akdev•5/14/23, 2:48 AM

yeah they do appear as they are not in /usr/etc

Ppythoner6 Eh but then should you be ending up with a new ostree deployment every time you ...

akdev•5/14/23, 2:48 AM

I'd be okay with that but there are some implications ...

akdev•5/14/23, 2:49 AM

but I would like it if

rm -rf /etc/*

rm -rf /etc/*

does not destroy the system

akdev•5/14/23, 2:49 AM

conceptually that should reset the system to default state

Aakdev I'd be okay with that but there are some implications ...

pythoner6OP•5/14/23, 2:50 AM

Yeah, in a future where things are more image based "native" I could see something along those lines being the case

Aakdev yeah they do appear as they are not in /usr/etc

pythoner6OP•5/14/23, 2:53 AM

I do see a /usr/etc/passwd and /usr/etc/shadow etc, but there's no passwords for any accounts, so a little hard to log in if things got reset to that

(unless there's something that goes through the first boot setup again or something?)

akdev•5/14/23, 2:54 AM

pretty sure your system is bricked

akdev•5/14/23, 2:54 AM

if you remove them

ragectl•5/14/23, 2:54 AM

yeah those files under /usr are probably only there to fix file not found errors

akdev•5/14/23, 2:55 AM

there are actual defaults for these files, wonder why those aren't used

akdev•5/14/23, 2:56 AM

$ podman run --rm -it fedora-minimal:38                                                
bash-5.2# cat /etc/passwd
root❌0:0:Super User:/root:/bin/bash
bin❌1:1:bin:/bin:/usr/sbin/nologin
daemon❌2:2:daemon:/sbin:/usr/sbin/nologin
adm❌3:4:adm:/var/adm:/usr/sbin/nologin
lp❌4:7:lp:/var/spool/lpd:/usr/sbin/nologin
sync❌5:0:sync:/sbin:/bin/sync
shutdown❌6:0:shutdown:/sbin:/sbin/shutdown
halt❌7:0:halt:/sbin:/sbin/halt
mail❌8:12:mail:/var/spool/mail:/usr/sbin/nologin
operator❌11:0:operator:/root:/usr/sbin/nologin
games❌12💯games:/usr/games:/usr/sbin/nologin
ftp❌14:50:FTP User:/var/ftp:/usr/sbin/nologin
nobody❌65534:65534:Kernel Overflow User:/:/usr/sbin/nologin

$ podman run --rm -it fedora-minimal:38                                                
bash-5.2# cat /etc/passwd
root❌0:0:Super User:/root:/bin/bash
bin❌1:1:bin:/bin:/usr/sbin/nologin
daemon❌2:2:daemon:/sbin:/usr/sbin/nologin
adm❌3:4:adm:/var/adm:/usr/sbin/nologin
lp❌4:7:lp:/var/spool/lpd:/usr/sbin/nologin
sync❌5:0:sync:/sbin:/bin/sync
shutdown❌6:0:shutdown:/sbin:/sbin/shutdown
halt❌7:0:halt:/sbin:/sbin/halt
mail❌8:12:mail:/var/spool/mail:/usr/sbin/nologin
operator❌11:0:operator:/root:/usr/sbin/nologin
games❌12💯games:/usr/games:/usr/sbin/nologin
ftp❌14:50:FTP User:/var/ftp:/usr/sbin/nologin
nobody❌65534:65534:Kernel Overflow User:/:/usr/sbin/nologin

ragectl•5/14/23, 2:56 AM

I could see a future state where /etc/shadow /etc/group /etc/passwd actually become

.d

.d

directories which get

include

include

-d

akdev•5/14/23, 2:56 AM

that cannot happen, it breaks POSIX

akdev•5/14/23, 2:56 AM

systemd has some sysusers thing tho

ragectl•5/14/23, 2:57 AM

not everything sticks to POSIX

akdev•5/14/23, 2:57 AM

the last 45 years or so of tooling assume that all your users are in /etc/passwd

akdev•5/14/23, 2:57 AM

this convention probably even predates POSIX

akdev•5/14/23, 2:58 AM

there's realistically no way we're going to change that imo

akdev•5/14/23, 2:58 AM

that's why even /etc/fstab doesn't change even though now it is used by systemd to generate mount units

ragectl•5/14/23, 2:58 AM

and they write things like SSSD that tells it to find users in places that are not /etc/passwd etc

ragectl•5/14/23, 2:58 AM

¯\_(ツ)_/¯

akdev•5/14/23, 2:59 AM

that's for networked authentication and SSSD has an option to keep /etc/passwd in sync

ragectl•5/14/23, 2:59 AM

I believe one of the changes that RHEL was considering for their Identity Management was actually removing reference to so it doesn't even look locally for user auth

Aakdev ``` $ podman run --rm -it fedora-minimal:38 ...

Arcitec•5/14/23, 3:00 AM

Pff everyone's passwords are

Back in my day, all passwords were stored plaintext, with the only protection being the root read permissions on the file.