Re: F27 System Wide Change: Reduce Initial Setup Redundancy

[Michael Catanzaro]

On Mon, Jul 10, 2017 at 12:12 PM, Reindl Harald 
<h.reindl(a)thelounge.net&gt; wrote:
>  and how do you imagine systemd to "get fixed"?
>  by allow the rescue target without authentication?
>  
>  at this point you are mostly in the dracut stuff
>  
>  that "popular pattern" needs to be fixed 
One option would be to prompt for username, and allow logins for any 
user in the admin group.

I don't see much point to having a rescue mode if it's never worked for 
the vast majority of its users (Ubuntu users).

Michael

F27 System Wide Change: Reduce Initial Setup Redundancy

[Chris Adams]

Once upon a time, Michael Catanzaro <mike.catanzaro(a)gmail.com&gt; said:
>  On Mon, Jul 10, 2017 at 12:12 PM, Reindl Harald
>  <h.reindl(a)thelounge.net&gt; wrote:
>  >and how do you imagine systemd to "get fixed"?
>  >by allow the rescue target without authentication?
>  >
>  >at this point you are mostly in the dracut stuff
>  >
>  >that "popular pattern" needs to be fixed
>  
>  One option would be to prompt for username, and allow logins for any
>  user in the admin group.
>  
>  I don't see much point to having a rescue mode if it's never worked
>  for the vast majority of its users (Ubuntu users). 
IIRC, the old initscripts used sushell (which just directly starts a
shell), and systemd switched to using sulogin (which requires a
password).

There are arguments for/against each, with "sulogin --force" in between
(my personal preference would be "sulogin --foce", but I recognize
that's just my preference).

What I would like to see with the current systemd setup is for what
shell is called to be more consistently configurable than grepping for
all the service files that call sulogin, copying them to
/etc/systemd/system, and doing a search/replace.  Right now, that means
that if there's a change to one of those service files, or if additional
service files are created that call sulogin/sushell, you'll miss on that
just because you wanted to change local policy for a portion of it.

IMHO it would be much better if there was a single place to set this
policy by default (and admins could still override it on a per-case
basis by replacing the service file).  Either use a file in
/etc/sysconfig or follow a symlink (although the "sulogin --force" can't
currently be achieved directly that way).

-- 
Chris Adams <linux(a)cmadams.net&gt;