Re: nsswitch: do not reload if "/" changes

[DJ Delorie via Libc-alpha <libc-alpha@sourceware.org>]

Florian Weimer <fweimer@redhat.com> writes:
> Are you concerned with the case that there are no NSS calls before
> entering the container, so that we don't initialize anything at all?

The key use case for this is tools that manage/debug/investigate the
contents of containers.  I would expect with those, they've done many
nss calls in order to authenticate, find the container, etc.

The *common* case for container entry is "enter container, exec some
other program".  That exec resets the nss lookup since it's a new
process.

> Hmm.  Upon second thought, I think this need to be made fail-closed by
> disabling reload on stat failure.  The two things aren't as unrelated as
> one might think (chroot + truning on some security filter doesn't seem
> to be uncommon).  Now of course it's a bit unlikely that anything can be
> loaded later if / can't be read, but is there a harm in macking this
> explicity?

Can we reuse the reloadable flag?  Or do we need a second independent
flag just for dll reloading?  IIRC we also use the reloadable flag for
test cases that override nsswitch.conf, so I would guess no.