Re: On the removal of nscd from Fedora, and the future of nscd.

["Ludovic Courtès" <ludo@gnu.org>]

DJ Delorie <dj@redhat.com> skribis:

> Ludovic Courts <ludo@gnu.org> writes:
>> This nscd requirement is one of the few must-haves to ensure, as
>> Joseph writes, that processes (in particular those linked against
>> Guix’s libc) do not end up dlopening arbitrary, possibly incompatible
>> libraries.
>
> My point is, if there's a risk that a Guix binary *could* load a host
> dso, then Guix is insufficiently isolated from the host system.  nscd is
> just one example of how this could happen.  If you accept this
> non-isolation, you need to accept that dsos need to be cross-usable.

Actually, by default, a Guix program on (say) Fedora-without-nscd won’t
dlopen Fedora’s libnss_sssd.so.  Instead, it’ll search in vain for
libnss_sssd.so in its search path (which does not include /usr/lib), and
have its name lookups fail with EAI_SYSTEM, ENOENT, or some other
unclear error.

IMO the situation of NSS is singular.  The use case of Guix, Nix, and
others is also very real, used today just fine even without full
isolation (separate namespaces & co.).

I hope this clarifies the context.

Ludo’.