byobu postinst interacts poorly with NSS_NONLOCAL_IGNORE

[broder]

Debathena wraps dpkg to set NSS_NONLOCAL_IGNORE=ignore (so that when dpkg tries to create new local system users, they don't conflict with Hesiod users):

From /usr/bin/dpkg.debathena:

#!/bin/sh
export NSS_NONLOCAL_IGNORE=ignore
/usr/bin/dpkg.debathena-orig "$@"

byobu attempts to trigger a profile reload on upgrade by trying to create a file for each user with an active screen session:

From /var/lib/dpkg/info/byobu.postinst:

# Notify users that they should reload their profile
DIR="/var/run/screen"
if [ -d "$DIR" ]; then
        for d in "$DIR"/*; do
                [ -d "$d" ] || continue
                touch "$d/$PKG.reload-required"
                u=$(echo "$d" | sed "s:^.*/S-::")
                chown $u "$d/$PKG.reload-required"
                chmod 700 "$d/$PKG.reload-required"
        done
fi

Unfortunately, because NSS_NONLOCAL_IGNORE means that non-local users don't exist, the byobu postinst attempts to chown files to nonexistant users:

Processing triggers for libc-bin ...
ldconfig deferred processing now taking place
Errors were encountered while processing:
 byobu
E: Sub-process /usr/bin/dpkg returned an error code (1)
A package failed to install.  Trying to recover:
Setting up byobu (2.68-0ubuntu1.1) ...
chown: invalid user: `geofft'
dpkg: error processing byobu (--configure):
 subprocess installed post-installation script returned error exit status 1
Errors were encountered while processing:
 byobu
Reading package lists... Done

[geofft]

I don't ... really know how we're supposed to go about fixing this.

Is there a way for us to set up things so that adding new users and groups works properly without setting NSS_NONLOCAL_IGNORE for the entire dpkg process? I see we already set it for adduser, so presumably there's a reason we also set it here?

Is there a way to hack up our dpkg wrapper to make specifically byobu work, e.g., sketching on the byobu postinst, or diverting and wrapping chown to determine if it was about to fail because NSS_NONLOCAL_IGNORE is set, and unsetting it? (Possibly defining NSS_NONLOCAL_IGNORE=dpkg and conditionalizing on that, or adding a new NSS_NONLOCAL_IGNORE_BECAUSE variable?) Since AIUI we more care about the user-adding process not failing because a user exists than making chown fail, that seems like it should be reasonably safe. It also terrifies me, so I'd prefer another route.

[andersk]

Replying to geofft:

Is there a way for us to set up things so that adding new users and groups works properly without setting NSS_NONLOCAL_IGNORE for the entire dpkg process? I see we already set it for adduser, so presumably there's a reason we also set it here?

I think the reason is that postinsts tend to check whether users and groups already exist with ‘getent’ before adding them.

Other solutions that come to mind include sketching a ‘getent’ wrapper into dpkg’s path, or sketching a flag for a global ‘getent’ wrapper into dpkg’s environment. (Either way we’d need to clean it up in invoke-rc.d, for the same reason that we clean up NSS_NONLOCAL_IGNORE there now.)

[andersk]

Ooh! This looks like it should be fixed in lucid-proposed and later by  LP:796422. Someone want to check?

[jdreed]

Fixed upstream.