Ensure GDM sees managed users after reboot - #1744
Conversation
adombeck
added
the
e2e-tests
I've encountered the case that an authd user that logged in on the system before was not listed in GDM after a reboot. Add an e2e-test which tests that. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
AccountsService can enumerate NSS users before authd has completed its socket-activated startup, leaving the GDM user cache without managed accounts until they log in once. Start authd as part of the NSS lookup target and make that target wait for the daemon to become ready. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
A failed or metadata-only-deleted live snapshot leaves its deterministic disk filename behind. Subsequent provisioning then cannot recreate the snapshot. Use a unique external disk and memory filename for each live snapshot instead. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
5b917a6 to
c641763
Compare
|
I verified that the new e2e-test fails without the Ensure GDM sees managed users after reboot commit and passes with that change |
|
There was a problem hiding this comment.
Pull request overview
This PR addresses a boot-time ordering issue where GDM/AccountsService can enumerate NSS users before the socket-activated authd daemon is fully started, causing managed users to be missing from the GDM user list until they log in once. It updates the systemd unit relationships to start authd earlier and adds an e2e test to ensure managed users appear in GDM after a reboot.
Changes:
- Adjust systemd unit dependencies/ordering so
authdis started ahead ofnss-user-lookup.target(which AccountsService uses as an ordering point). - Add an e2e Robot Framework test covering “managed user listed by GDM after reboot”.
- Make VM snapshot creation more collision-resistant by using unique external snapshot disk/memory filenames.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| e2e-tests/vm/lib/libprovision.sh | Avoid snapshot file collisions by generating unique external snapshot filenames. |
| e2e-tests/tests/gdm_managed_user_after_reboot.robot | New e2e regression test validating GDM lists an existing managed user after reboot. |
| debian/authd.socket | Ensure authd.service is pulled in early (with the socket) before NSS lookup target is reached. |
| debian/authd.service.in | Order authd.service before nss-user-lookup.target so the target waits for readiness (Type=notify). |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Wait Until Keyword Succeeds 3 min 1 sec | ||
| ... SSH.Execute systemctl is-system-running --wait |
There was a problem hiding this comment.
@copilot ok, but then extract a keyword for this
There was a problem hiding this comment.
Addressed in e6cd694.
I extracted the reboot readiness wait into a shared Robot keyword (Wait Until System Is Running Or Degraded) in e2e-tests/resources/utils.resource, and updated gdm_managed_user_after_reboot.robot to use it.
| ${display_name} = SSH.Execute getent passwd ${username} | cut -d: -f5 | cut -d, -f1 | ||
|
|
| # AccountsService starts after this target to populate the GDM user list. | ||
| Before=nss-user-lookup.target |
There was a problem hiding this comment.
Why this is needed if the service needs the socket that should be before the lookup?
AccountsService can enumerate NSS users before authd has completed its socket-activated startup, leaving the GDM user cache without managed accounts until they log in once. Start authd as part of the NSS lookup target and make that target wait for the daemon to become ready.
Also adds an e2e-test to test that the authd user shows up in GDM after a reboot.
Closes #1743
UDENG-11043