Change:
Currently, seems to be broken. I thought this was a systemd issue, but they claim it's because we misconfigured . However, I thought we configured this correctly since since this commit and seems to indeed confirm this. Yet is still currently broken in . I have a feeling isn't correctly loading that aren't shipped with . This would mean and aren't loaded either if that's the case Please run and paste the results.
Related
Also related:
Also related: It seems like isn't properly loading all
When I run It seems to try to load all the from a very strange_ location, confirming my suspicion that isn't loading any of the NSS modules out side of Anything but the right place. So loading custom modules seems to be broken.
Okay so it actually does seem to load the libraries, after suggestion from Then why is not working?
cc
Also cc who originally fixed this
You can use and watch for dbus calls named to the service
In you should see a unix socket connection opened to dbus follow by system calls on the resulting file descriptor.
The call is being made. I more and more suspect this being a systemd issue
The response looks as expected.
Indeed. so why is the systemd unit then failing on ?
Ah I also get this in the logs: Here is the full trace:
This error seems to be coming from which leads us to:
After hacking around with this turns out to be a cache invalidation problem. See Since we only use for tricking to load nss modules from an absolute path, and actually not for its caching behaviour the recommended course of action seems to be to disable all caching that provides (at least for passwd and group, perhaps not for host) This is already disabled when is enabled () So the simplest option seems to be to also use this config when is disabled. Note (this should probably be documented somewhere) we can't fully disable the cache, as then will not preload the , and delegate that to instead, which will cause to not be able to find the modules, as they are not in the global . To trick into loading these modules from a pure path, we enable caching but set all to .
Awesome detective work!
Since upstream systemd merged their nscd cache invalidation fix and released it in v240, and we're on v242 now, should some caching be turned on again? Seems to me like it'd be nice, but I can't imagine getent lookups are hugely performance-critical. :man_shrugging: Either way though, perhaps you folks would be good reviewers for my pull request , which gets rid of various years-old cruft from the nscd module. If non-zero TTLs are still worth-while, I'd hope my patches would be merged first.

Discussion:
</listitem> <listitem> <para> <ins> The <literal>nscd</literal> service now disables all caching of <literal>passwd</literal> and <literal>group</literal> databases by default. This was interferring with the correct functioning of the <literal>libnss_systemd.so</literal> module which is used by <literal>systemd</literal> to manage uids and usernames in the presence of <literal>DynamicUser=</literal> in systemd services.  This was already the default behaviour in presence of <literal>services.sssd.enable = true</literal> because nscd caching would interfere with <literal>sssd</literal> in unpredictable ways as well.  Because we're using nscd not for caching, but for convincing glibc to find NSS modules in the nix store instead of an absolute path, we have decided to disable caching globally now, as it's usually not the behaviour the user wants and can lead to surprising behaviour.  Furthermore, negative caching of host lookups is also disabled now by default. This should fix the issue of dns lookups failing in the presence of an unreliable network. </para> <para> If the old behaviour is desired, this can be restored by setting the <literal>services.nscd.config</literal> option with the desired caching parameters. <programlisting> services.nscd.config = '' server-user             nscd threads                 1 paranoia                no debug-level             0 enable-cache            passwd          yes positive-time-to-live   passwd          600 negative-time-to-live   passwd          20 suggested-size          passwd          211 check-files             passwd          yes persistent              passwd          no shared                  passwd          yes enable-cache            group           yes positive-time-to-live   group           3600 negative-time-to-live   group           60 suggested-size          group           211 check-files             group           yes persistent              group           no shared                  group           yes enable-cache            hosts           yes positive-time-to-live   hosts           600 negative-time-to-live   hosts           5 suggested-size          hosts           211 check-files             hosts           yes persistent              hosts           no shared                  hosts           yes ''; </programlisting> See <link xlink:href="https://github.com/NixOS/nixpkgs/pull/50316">#50316</link> for details. </para> </listitem> <listitem> <para> </ins> GitLab Shell previously used the nix store paths for the <literal>gitlab-shell</literal> command in its <literal>authorized_keys</literal> file, which might stop working after

<del> server-user             nscd threads                 1 paranoia                no debug-level             0 enable-cache            passwd          yes positive-time-to-live   passwd          0 negative-time-to-live   passwd          0 suggested-size          passwd          211 check-files             passwd          yes persistent              passwd          no shared                  passwd          yes enable-cache            group           yes positive-time-to-live   group           0 negative-time-to-live   group           0 suggested-size          group           211 check-files             group           yes persistent              group           no shared                  group           yes enable-cache            hosts           yes positive-time-to-live   hosts           600 negative-time-to-live   hosts           5 suggested-size          hosts           211 check-files             hosts           yes persistent              hosts           no shared                  hosts           yes enable-cache            services        yes positive-time-to-live   services        0 negative-time-to-live   services        0 suggested-size          services        211 check-files             services        yes persistent              services        no shared                  services        yes </del>

}; system.nssModules = optional cfg.enable pkgs.sssd; <del> services.nscd.config = builtins.readFile ./nscd-sssd.conf; </del> services.dbus.packages = [ pkgs.sssd ]; })

<ins> # We basically use nscd as a proxy for forwarding nss requests to appropriate # nss modules, as we run nscd with LD_LIBRARY_PATH set to the directory # containing all such modules # Note that we can not use `enable-cache no` As this will actually cause nscd # to just reject the nss requests it receives, which then causes glibc to # fallback to trying to handle the request by itself. Which won't work as glibc # is not aware of the path in which the nss modules live.  As a workaround, we # have `enable-cache yes` with an explicit ttl of 0 </ins> server-user             nscd threads                 1 paranoia                no debug-level             0 enable-cache            passwd          yes <del> positive-time-to-live   passwd          600 negative-time-to-live   passwd          20 </del> <ins> positive-time-to-live   passwd          0 negative-time-to-live   passwd          0 </ins> suggested-size          passwd          211 check-files             passwd          yes persistent              passwd          no shared                  passwd          yes enable-cache            group           yes <del> positive-time-to-live   group           3600 negative-time-to-live   group           60 </del> <ins> positive-time-to-live   group           0 negative-time-to-live   group           0 </ins> suggested-size          group           211 check-files             group           yes persistent              group           no shared                  group           yes <ins> enable-cache            netgroup        yes positive-time-to-live   netgroup        0 negative-time-to-live   netgroup        0 suggested-size          netgroup        211 check-files             netgroup        yes persistent              netgroup        no shared                  netgroup        yes </ins> enable-cache            hosts           yes positive-time-to-live   hosts           600 <del> negative-time-to-live   hosts           5 </del> <ins> negative-time-to-live   hosts           0 </ins> suggested-size          hosts           211 check-files             hosts           yes persistent              hosts           no shared                  hosts           yes <ins> enable-cache            services        yes positive-time-to-live   services        0 negative-time-to-live   services        0 suggested-size          services        211 check-files             services        yes persistent              services        no shared                  services        yes </ins>

$machine->succeed('test -z $(ls -1 /var/log/journal)'); }; <ins> # Regression test for https://github.com/NixOS/nixpkgs/issues/50273 subtest "DynamicUser actually allocates a user", sub { $machine->succeed('systemd-run --pty --property=Type=oneshot --property=DynamicUser=yes --property=User=iamatest whoami | grep iamatest'); }; </ins> # Regression test for https://github.com/NixOS/nixpkgs/issues/35268 subtest "file system with x-initrd.mount is not unmounted", sub { $machine->shutdown;