diff options
author | Florian Klink <flokli@flokli.de> | 2021-07-17 19:41:45 +0200 |
---|---|---|
committer | Florian Klink <flokli@flokli.de> | 2021-07-17 23:55:35 +0200 |
commit | c1536f5c78ead2fdcb0ec11824d673638fa6a5f4 (patch) | |
tree | d3b81c2f2ce04c82955b708be690981460123425 /nixos/doc/manual/from_md | |
parent | b59c06dc92f8d03660eb4155754d93a6c34cda83 (diff) | |
download | nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.gz nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.bz2 nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.lz nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.xz nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.tar.zst nixpkgs-c1536f5c78ead2fdcb0ec11824d673638fa6a5f4.zip |
nixos/systemd: fix NSS database ordering
- The order of NSS (host) modules has been brought in line with upstream recommendations: - The `myhostname` module is placed before the `resolve` (optional) and `dns` entries, but after `file` (to allow overriding via `/etc/hosts` / `networking.extraHosts`, and prevent ISPs with catchall-DNS resolvers from hijacking `.localhost` domains) - The `mymachines` module, which provides hostname resolution for local containers (registered with `systemd-machined`) is placed to the front, to make sure its mappings are preferred over other resolvers. - If systemd-networkd is enabled, the `resolve` module is placed before `files` and `myhostname`, as it provides the same logic internally, with caching. - The `mdns(_minimal)` module has been updated to the new priorities. If you use your own NSS host modules, make sure to update your priorities according to these rules: - NSS modules which should be queried before `resolved` DNS resolution should use mkBefore. - NSS modules which should be queried after `resolved`, `files` and `myhostname`, but before `dns` should use the default priority - NSS modules which should come after `dns` should use mkAfter.
Diffstat (limited to 'nixos/doc/manual/from_md')
-rw-r--r-- | nixos/doc/manual/from_md/release-notes/rl-2111.section.xml | 71 |
1 files changed, 71 insertions, 0 deletions
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml index fcaac9e8bec..e923a289442 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml @@ -562,6 +562,77 @@ be removed in 22.05. </para> </listitem> + <listitem> + <para> + The order of NSS (host) modules has been brought in line with + upstream recommendations: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + The <literal>myhostname</literal> module is placed before + the <literal>resolve</literal> (optional) and + <literal>dns</literal> entries, but after + <literal>file</literal> (to allow overriding via + <literal>/etc/hosts</literal> / + <literal>networking.extraHosts</literal>, and prevent ISPs + with catchall-DNS resolvers from hijacking + <literal>.localhost</literal> domains) + </para> + </listitem> + <listitem> + <para> + The <literal>mymachines</literal> module, which provides + hostname resolution for local containers (registered with + <literal>systemd-machined</literal>) is placed to the + front, to make sure its mappings are preferred over other + resolvers. + </para> + </listitem> + <listitem> + <para> + If systemd-networkd is enabled, the + <literal>resolve</literal> module is placed before + <literal>files</literal> and + <literal>myhostname</literal>, as it provides the same + logic internally, with caching. + </para> + </listitem> + <listitem> + <para> + The <literal>mdns(_minimal)</literal> module has been + updated to the new priorities. + </para> + </listitem> + </itemizedlist> + <para> + If you use your own NSS host modules, make sure to update your + priorities according to these rules: + </para> + <itemizedlist spacing="compact"> + <listitem> + <para> + NSS modules which should be queried before + <literal>resolved</literal> DNS resolution should use + mkBefore. + </para> + </listitem> + <listitem> + <para> + NSS modules which should be queried after + <literal>resolved</literal>, <literal>files</literal> and + <literal>myhostname</literal>, but before + <literal>dns</literal> should use the default priority + </para> + </listitem> + <listitem> + <para> + NSS modules which should come after <literal>dns</literal> + should use mkAfter. + </para> + </listitem> + </itemizedlist> + </listitem> </itemizedlist> </section> </section> |