1

On CoreOS EC2 instance, I find the following:

$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
core:x:500:500:CoreOS Admin:/home/core:/bin/bash
$ cat /etc/group    
wheel:x:10:root,core
sudo:x:150:
docker:x:233:core
$ id
uid=500(core) gid=500(core) groups=500(core),10(wheel),233(docker),248(systemd-journal),250(portage)
  1. Where is the core group defined?

  2. What commands can I use to change the uid and gid of the core user/group, say in a systemd unit executed at startup?

update: this seems to be related to the contents of /usr/share/baselayout/group, which does contain the core group, but I can't find any link to that file anywhere.

2

Given the passwd and group files that you've posted, there is no group called core on your system. There is a user called core, with user ID 500, and whose primary group has the group ID 500. The group 500 has no name given in these files.

It's possible that group 500 has a name given in another database. The databases for users and groups are configured in /etc/nsswitch.conf. You can query them with the getent command:

getent group 500

On CoreOS, /etc/nsswitch.conf contains usrfiles, which appears to be a CoreOS extension. It works like files, but looking under /usr/share/baselayout instead of /etc. Thus files usrfiles means that /etc/group will be consulted, then /usr/share/baselayout/group.

Users and groups are usually not created on the fly, at boot time or otherwise; they are persistent system configuration. You could call commands like adduser, addgroup, etc. from a Systemd unit, but that is fairly rare. I'm not familiar with CoreOS, but I highly doubt that creating a user or group called core at boot time would achieve anything useful. If you want to give group 500 a name, create an entry in /etc/group with addgroup. If you want to create a user or a group for your own purposes, use adduser and addgroup, and don't reuse a name or number that's already taken.

5
  • CoreOS really does seem to know more than what's listed in /etc/group as you can see from the output of id. I confirmed that getgrgid(500) returns a pointer to struct describing the core group. Aug 18 '14 at 15:22
  • Your answer to question 2. "How can I change the uid/gid?" is clear: "don't, just create a new user/group." But you haven't answered question 1. "How does CoreOS get its information about users and groups?" Maybe they should really be two separate questions. Aug 18 '14 at 15:26
  • 1
    @AryehLeibTaurog Good point, see my edit (sorry for the delay). Aug 21 '14 at 9:27
  • /etc/nsswitch.conf is a symbolic link to /usr/share/baselayout/nsswitch.conf. There's a line in there that reads group: files usrfiles but I don't see where the meaning of usrfiles is defined. Aug 21 '14 at 13:03
  • @AryehLeibTaurog I see. It appears to be a CoreOS extension which is like files, but looking under /usr/share/baselayout instead of /etc. Thus it means that /usr/share/baselayout/group will be consulted. Aug 21 '14 at 13:18
0

Perhaps someone else can post details of how exactly it works, but this at least seems somewhat of a sufficient explanation:

On a CoreOS machine, the operating system itself is mounted as a read-only partition at /usr.

Instead of changing the uid/gid I just created a new user/group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.