bug/question: should `_daemon_` be set with `*` password field?

Metadata

Project: rockcraft
Number: #1343
Type: issue
State: open
Author: cjdcordeiro
Labels: —
Created: 2026-08-21 03:46 PM UTC
Updated: 2026-09-02 04:34 PM UTC
Closed: —

Current evaluation

Suggests setting the pebble user entry in /etc/passwd to '*' (or conditionally on /etc/shadow existing) instead of 'x' for container-oriented no-login behaviour. cmatsuoka endorsed '*'. Still open; oci.py add_user unchanged.

Suggested action: keep open

Reason: The code at rockcraft/oci.py (Image.add_user) still writes f"{username}:x:{uid}:{uid}::...:/usr/bin/false\n" unconditionally, while the shadow entry is only appended 'if user_files["shadow"]' — so the reported mismatch (x pointing at a possibly-absent /etc/shadow) still exists. The author is a maintainer and cmatsuoka replied endorsing '*' as 'the standard choice with no further resolution required', so the design decision is effectively settled, but no code change has landed and no labels/triage state are recorded.

Evaluated by: mr-cal-bot

Impact: 30 Quick Win: 18 Complexity: 12 Confidence: 80 Actionability: 70

Issue body

https://github.com/canonical/rockcraft/blob/6ab35d9d56980a5eb4d45ff70a94621fbc815673/rockcraft/oci.py#L280 At the moment, the `/etc/passwd` entry is getting set with `x`, which may cause a lookup to `/etc/shadow`, a file that may not exist. So the first question/bug is that we may want to define the `_daemon_` entry in `/etc/passwd` based on the existence of a shadow file. Moreover, this is a container, so we could also take a more opinionated approach by saying that interactive login is disabled by default, and thus set this line's password field to `*` instead of `x`. That would be consistent with the default `base-passwd` config files and allow for a more container-oriented behavior (i.e. no interactive login, but still allow using the account for container services). What do you think?

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-02 08:34 PM UTC	stealth/space-bunny-alpha	Impact: 30 Quick Win: 18 Complexity: 12 Confidence: 80 Actionability: 70	keep open	Suggests setting the pebble user entry in /etc/passwd to '' (or conditionally on /etc/shadow existing) instead of 'x' for container-oriented no-login behaviour. cmatsuoka endorsed ''. Still open; oci.py add_user unchanged.
2026-09-24 09:22 PM UTC	stealth/space-bunny-alpha	Impact: 35 Quick Win: 22 Complexity: 25 Confidence: 91 Actionability: 82	keep open	Open: generated service accounts use x in /etc/passwd even without /etc/shadow; maintainer discussion favors * to disable interactive login, but the code remains unchanged.
2026-09-06 03:48 AM UTC	qwen3.6-35b-a3b-mtp-q6	Impact: 30 Quick Win: 26 Staleness: 10 Complexity: 15 Confidence: 70 Support Request: 10	keep open	Discussion about whether _daemon_ user's /etc/passwd password field should be * instead of x to avoid shadow file lookup in containers.
2026-08-21 03:52 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 5 Complexity: 15 Confidence: 90 Support Request: 10	needs triage	Question regarding whether the _daemon_ password field in /etc/passwd should be * instead of x for container security. Currently unlabelled and awaiting team discussion.

Update history

Date	Change
2026-09-02 04:34 PM UTC	updated
2026-08-21 03:46 PM UTC	created

Related issues

No related issues found above the similarity threshold.