diff options
| author | Zuul <zuul@review.opendev.org> | 2020-07-06 14:33:01 +0000 |
|---|---|---|
| committer | Gerrit Code Review <review@openstack.org> | 2020-07-06 14:33:01 +0000 |
| commit | 22d7ffa382ea7a7a6bd0ac1b46699529175d7328 (patch) | |
| tree | 09ca1d0117f9a88eaac01852a9d5a8a3570428b7 | |
| parent | 70ffba824177e967e5829852b534e05f50486745 (diff) | |
| parent | dc2ddfa9750f94430a5b04b62fc1fa6adcb234f8 (diff) | |
| download | kolla-22d7ffa382ea7a7a6bd0ac1b46699529175d7328.tar.gz kolla-22d7ffa382ea7a7a6bd0ac1b46699529175d7328.zip | |
Merge "Drop systemd support from nsswitch.conf on RHEL-based distros"
| -rw-r--r-- | docker/base/Dockerfile.j2 | 3 | ||||
| -rw-r--r-- | releasenotes/notes/disable-systemd-nss-on-rhel-based-distros-5d586fcdb9a82da7.yaml | 7 |
2 files changed, 9 insertions, 1 deletions
diff --git a/docker/base/Dockerfile.j2 b/docker/base/Dockerfile.j2 index 4a2b31d13..e47979472 100644 --- a/docker/base/Dockerfile.j2 +++ b/docker/base/Dockerfile.j2 @@ -416,7 +416,8 @@ RUN apt-get update \ {% endif %} {% if base_distro == 'centos' or base_distro == 'rhel' %} -RUN sed -ri '/-session(\s+)optional(\s+)pam_systemd.so/d' /etc/pam.d/system-auth +RUN sed -ri '/-session(\s+)optional(\s+)pam_systemd.so/d' /etc/pam.d/system-auth \ + && sed -ri '/^[^#]/ s/systemd//g' /etc/nsswitch.conf {% endif %} COPY set_configs.py /usr/local/bin/kolla_set_configs diff --git a/releasenotes/notes/disable-systemd-nss-on-rhel-based-distros-5d586fcdb9a82da7.yaml b/releasenotes/notes/disable-systemd-nss-on-rhel-based-distros-5d586fcdb9a82da7.yaml new file mode 100644 index 000000000..78521b9dc --- /dev/null +++ b/releasenotes/notes/disable-systemd-nss-on-rhel-based-distros-5d586fcdb9a82da7.yaml @@ -0,0 +1,7 @@ +--- +fixes: + - | + Drop systemd support from nsswitch.conf on RHEL-based distros. This avoids + unneeded systemd nss lookups inside containers and it also avoids possible + selinux denials when a container bind mounts /run and makes the dbus socket + available inside the container only to be denied by selinux on the host. |