Skip to content

Manually create the _apt user if DPKG_ROOT is set

Johannes Schauer Marin Rodrigues requested to merge josch/apt:dpkg-root into main

adduser doesn't understand DPKG_ROOT. So if this is an installation with dpkg --force-script-chrootless, and if /etc/passwd is the same as passwd.master with shadowed passwords turned on then we fill /etc/passwd and /etc/shadow manually to create a bit-by-bit identical situation as adduser would've done it.

This code path will never be executed during normal installations, so even though it is ugly and hacky, it should not result in any bugs for our users.

The code is regularly tested in our CI framework on Salsa: https://salsa.debian.org/helmutg/dpkg-root-demo/

Adding support for DPKG_ROOT to adduser would require extensive changes to adduser for the sole benefit of creating the _apt user. No other package postinst would benefit from these changes to adduser. Instead of adding a lot of complexity to adduser for a use-case that doesn't concern normal installations and thus also exposing normal users to bugs introduced by these changes, we instead add a small-ish hack to the apt postinst.

Another way to fix this would be a APT_POSTINST_NO_ADDUSER environment variable which would prevent the _apt user from being created if it is set to yes.

And yet another way to fix it would be to use systemd-sysusers and add a dependency on systemd | systemd-sysusers which can also be satisfied by the systemd-standalone-sysusers package if installing systemd itself is not desired.

Edited by Johannes Schauer Marin Rodrigues

Merge request reports

Loading