bug/question: should `_daemon_` be set with `*` password field?
Metadata
Current evaluation
Discussion about whether _daemon_ user's /etc/passwd password field should be * instead of x to avoid shadow file lookup in containers.
Suggested action: keep open
Reason: The issue is clearly scoped as a design decision about the _daemon_ user's password field and has active maintainer discussion (@cmatsuoka commented 3 days ago supporting *). It requires a deliberate choice between x and * for /etc/passwd entries, so it should remain open for resolution.
Impact:
30
Quick Win:
25.5
Staleness:
10
Complexity:
15
Confidence:
70
Support Request:
10
Issue body
https://github.com/canonical/rockcraft/blob/6ab35d9d56980a5eb4d45ff70a94621fbc815673/rockcraft/oci.py#L280
At the moment, the `/etc/passwd` entry is getting set with `x`, which may cause a lookup to `/etc/shadow`, a file that may not exist. So the first question/bug is that we may want to define the `_daemon_` entry in `/etc/passwd` based on the existence of a shadow file.
Moreover, this is a container, so we could also take a more opinionated approach by saying that interactive login is disabled by default, and thus set this line's password field to `*` instead of `x`. That would be consistent with the default `base-passwd` config files and allow for a more container-oriented behavior (i.e. no interactive login, but still allow using the account for container services).
What do you think?
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 |
Impact:
30
Quick Win:
25.5
Staleness:
10
Complexity:
15
Confidence:
70
Support Request:
10
|
keep open | Discussion about whether _daemon_ user's /etc/passwd password field should be * instead of x to avoid shadow file lookup in containers. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
5
Complexity:
15
Confidence:
90
Support Request:
10
|
needs triage | Question regarding whether the _daemon_ password field in /etc/passwd should be * instead of x for container security. Currently unlabelled and awaiting team discussion. |
Update history
| Date | Change |
|---|---|
| updated | |
| created |
Related issues
No related issues found above the similarity threshold.