Enable the nss-systemd service

[heitbaum]

Details of the nss-systemd service

• https://www.freedesktop.org/software/systemd/man/latest/nss-systemd.html#

Background

Updated addon component nqptp which previously dropped root privileges has been changed to use CAP_NET_BIND_SERVICE functionality in systemd. Instead of creating a user/group in /etc/passwd use the DynamicUser systemd functionality. This functionality is independent of the nss-systemd service - but to allow user/group resolution - the nss-systemd service is required.

Example status of systemd service using DynamicUser

nuc12:~ # systemctl status service.nqptp
● nqptp.service - NQPTP -- Not Quite PTP
     Loaded: loaded (/storage/.config/system.d/nqptp.service; linked; preset: disabled)
     Active: active (running) since Tue 2024-03-05 09:30:38 UTC; 2 days ago
   Main PID: 3698 (nqptp)
      Tasks: 1 (limit: 37511)
     Memory: 236.0K (peak: 340.0K)
        CPU: 16min 49.603s
     CGroup: /system.slice/nqptp.service
             └─3698 /storage/.kodi/addons/service.nqptp/bin/nqptp

Mar 05 09:30:38 nuc12 systemd[1]: Started nqptp.service.

DynamicUser process (without nss-systemd)

nuc12:~ # ps -ef | grep nqptp
 3698 62946    16:49 /storage/.kodi/addons/service.nqptp/bin/nqptp

DynamicUser process (with nss-systemd)

nuc12:~ # ps -ef | grep nqptp
 3698 nqptp     16:49 /storage/.kodi/addons/service.nqptp/bin/nqptp

Example systemd service using DynamicUser

nuc12:~ # cat .config/system.d/service.nqptp.service 
[Unit]
Description=NQPTP -- Not Quite PTP
Wants=network-online.target
After=network.target network-online.target

[Service]
ExecStart=/storage/.kodi/addons/service.nqptp/bin/nqptp
DynamicUser=yes
User=nqptp
Group=nqptp
AmbientCapabilities=CAP_NET_BIND_SERVICE

[Install]                   
WantedBy=kodi.target