Bug 9789 - systemd rootfs-postprocess command should check staticids
Summary: systemd rootfs-postprocess command should check staticids
Status: RESOLVED FIXED
Alias: None
Product: OE-Core
Classification: Build System, Metadata & Runtime
Component: core (show other bugs)
Version: 2.1
Hardware: x86 Multiple
: Medium normal
Target Milestone: 6.99
Assignee: Himani Barde
QA Contact:
URL:
Whiteboard: RETEST
Depends on:
Blocks:
 
Reported: 2016-06-16 15:43 UTC by Stephano Cetola
Modified: 2026-06-29 14:07 UTC (History)
7 users (show)

See Also:
OS type for building Yocto: ---
Type of Regression: ---
Verified:
Documentation change: No (bug/feature does not impact docs)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Stephano Cetola 2016-06-16 15:43:48 UTC
In rootfs-postcommands.bbclass, systemd_create_users does not check the staticids data to ensure that any of the groups or users it is creating has been marked with a static id.
Comment 1 Patrick Ohly 2017-05-08 07:18:10 UTC
Here's how Ostro OS solved this:
https://github.com/ostroproject/ostro-os/commits/master/meta-ostro/classes/systemd-sysusers.bbclass
Comment 2 Patrick Ohly 2017-05-08 07:19:00 UTC
Refkit still has the same class.
Comment 3 Patrick Ohly 2017-09-25 13:29:53 UTC
I'm running into this in another distro. Is this still on the table for fixing in 2.4?
Comment 4 Stephano Cetola 2017-09-26 13:26:12 UTC
I believe the window for 2.4M4 has closed though I will discuss this with the team today. If it is possible to include this in 2.4 I'll get it submitted today.
Comment 5 Stephano Cetola 2017-09-27 21:34:33 UTC
Moving this to 2.5M1. I will backport to Rocko (2.4.1) if needed.
Comment 6 Randy MacLeod 2023-10-24 14:24:36 UTC
Bulk move from 4.99 or 0.00 to 5.99
Comment 7 Randy MacLeod 2026-06-18 15:29:51 UTC
Himani - please take a look and see if you can retest.
Comment 8 Himani Barde 2026-06-29 12:41:58 UTC
Retested on openembedded-core master branch.

The original issue has been fixed by commit 0c7e76df68 ("rootfs-postcommands: change sysusers.d command", 2023-06-15) by Louis Rannou.

The old systemd_create_users function, which created users/groups at rootfs time without checking static IDs, has been completely replaced by systemd_sysusers_check. The new function does NOT create users/groups — it only validates that users/groups defined in sysusers.d/*.conf already exist in /etc/passwd and /etc/group with consistent properties.

Static IDs are now enforced by useradd-staticids.bbclass at recipe parse time, before any user creation occurs. The rootfs postprocess step just verifies consistency afterward.

A follow-up commit 2a700c3102 (2023-12-27) further relaxed the check to ignore comment mismatches.

This bug can be marked as RESOLVED/FIXED.
Comment 9 Randy MacLeod 2026-06-29 14:07:48 UTC
As per Himani's comment. 

Stephano, re-open if you disagree.