[Nss-mysql-users] Some programs not loading libnss_mysql.so...

[Michael Chang]

After testing nss-mysql out for a while, I decided to finally give it a 
run for its money on a production server (please stave off your flames).

_Most_ applications worked just fine, but there were a few, notably 
httpd, which did not even query the database server at all -- nothing
was showing up in mysqld.log on the database server.

F.Y.I.: The setup I had used was to keep all the passwd and group entries 
for system services (UID < 500) in /etc/passwd and /etc/group, 
respectively, and all user accounts in the database.  /etc/nsswitch.conf 
was setup to use flat files before the database.

The symptom: requests for http://.../~<username> failed because the user 
could not be looked up.

Doing a `cat /proc/<pid-of-master-httpd-process>/maps | grep nss' only
showed an entry for libnss_files.so.  This remained so even after 
restarting httpd.  My only guess is that httpd is statically dlopen()-ing 
libnss_files.so without first loading libnss itself (which would have 
looked up the appropriate entries in /etc/nsswitch.conf and then loaded
libnss_mysql.so if needed).

First question: Is this behaviour of apache against standards?  (Is the
use of NSS even a "standard" at all, or is it just a Linux and Solaris 
thing?)


My only recourse was to `export LD_PRELOAD=/usr/lib/libnss_mysql.so' in 
the httpd startup script.  Now everything works as expected.  I had to do 
the same with sendmail, as well, since it was spewing "User unknown" 
messages without it.


Second question: Is using LD_PRELOAD in this way and in this context a 
safe and reliable thing to do?



Regards,
Michael







-- 
/* BEGIN SIG 
*
* "Afraid of change, afraid of staying the same,
*  when temptation calls, we just look away."
*  - Barenaked Ladies
*
* "He started writing in mirror writing, 'Help! I'm
*  trapped behind the world.'"
*  - New York State Journal of Medicine
*
*-----------------------------
* Michael Chang
* address@hidden
* http://www.syndetic.org/
*/