Puppet

Sorry, we’ve got a backlog of submitted patches that we’re trying to work through. I’ve commented on the mailing list – let’s have a discussion there.

Jesse Wolfe wrote: […]

2) There’s a design question about whether parsing files in /etc/ is really “correct” – it might make more sense to supplement the information returned by getent with metadata about whether the user is locally deletable

Other than total guesswork, it isn’t actually possible for us to determine that ahead of time, only when we try and perform the operation.

For example, it would be possible for some-but-not-all of the Active Directory integrated systems I ran to delete somewhat varying sets of users “remotely” using the appropriate local tools, at a site a few years back. (Specifically, different machines in different “divisions” had different security rules; our adduser and deluser tools were configured appropriately to be able to delete things in the AD data store.)

The same is true of LDAP, NIS, and various other unconventional data stores. (eg: pam-mysql could totally replace /etc/passwd, but entirely preserve the ability to delete users using the same API.)

So, I would suggest that this is impossible to satisfy except in limited circumstances, and doing so would require bypassing the NSS service entirely to determine that metadata. Plus, on a non-trivial number of platforms we don’t even have that rich a view of providers. (eg: Win32).

If we do accept something like this, it would need to be done in a way that it was optional, and non-default, to ensure that we don’t stop working for configurations that don’t match that specific set of assumptions.