[OPENJDK-493] Don't install NSS Wrapper for OpenJDK17 containers

Introduce a new module jboss.container.util.nss-wrapper to encapsulate
the nss_wrapper config introduced with OPENJDK-312.

Move (almost) all nss_wrapper configuration into the new module.
(The configure_passwd function in run-java.sh remains, however, it's
benign. To remove this we need to extend run-java to support pluggable
functionality.)

Add the new module as an explicit dependency to the images which use
it, that is, all of the full-fat images.

No changes made to the OpenJDK 17 descriptor, which means it should
omit the nss_wrapper configuration entirely.

Signed-off-by: Jonathan Dowland <[email protected]>

Author: jmtd

modules/run/module.yaml

@@ -48,24 +48,12 @@ envs:
 - name: JAVA_ARGS
   description: Arguments passed to the `java` application.
 
-- name: LD_PRELOAD
-  value: libnss_wrapper.so
-- name: NSS_WRAPPER_PASSWD
-  value: /home/jboss/passwd
-- name: NSS_WRAPPER_GROUP
-  value: /etc/group
-
 execute:
 - script: configure.sh
 - script: backward_compatibility.sh
 
 modules:
   install:
-  - name: jboss.container.user
   - name: jboss.container.java.jvm.bash
   - name: jboss.container.util.logging.bash
   - name: jboss.container.openjdk.jdk
-
-packages:
-  install:
-  - nss_wrapper

modules/user/configure.sh

@@ -2,9 +2,7 @@
 set -e
 
 # Create a user and group used to launch processes
-# We use the ID 185 fot the group as well as for the user.
+# We use the ID 185 for the group as well as for the user.
 # This ID is registered static ID for the JBoss EAP product
 # on RHEL which makes it safe to use.
 groupadd -r jboss -g 185 && useradd -u 185 -r -g root -G jboss -m -d /home/jboss -s /sbin/nologin -c "JBoss user" jboss
-cp /etc/passwd /home/jboss/passwd
-chmod ug+rwX /home/jboss /home/jboss/passwd

modules/util/nss-wrapper/configure.sh

@@ -0,0 +1,6 @@
+#!/bin/bash
+set -euo pipefail
+
+# set up a copy of the passwd file which nss_wrapper will use.
+cp /etc/passwd /home/jboss/passwd
+chmod ug+rwX /home/jboss /home/jboss/passwd

modules/util/nss-wrapper/module.yaml

@@ -0,0 +1,27 @@
+schema_version: 1
+name: jboss.container.util.nss-wrapper
+version: '1.0'
+description: ^
+  Installs and configures NSS wrapper.
+  See <https://issues.redhat.com/browse/OPENJDK-312>.
+
+envs:
+- name: LD_PRELOAD
+  value: libnss_wrapper.so
+- name: NSS_WRAPPER_PASSWD
+  value: /home/jboss/passwd
+- name: NSS_WRAPPER_GROUP
+  value: /etc/group
+
+execute:
+- script: configure.sh
+
+packages:
+  install:
+  - nss_wrapper
+
+# We don't explicitly depend on jboss.container.user but that module must
+# be evaluated before this one.
+modules:
+  install:
+  - name: jboss.container.user

openjdk-11-rhel7.yaml

@@ -44,6 +44,7 @@ modules:
     version: "7"
   - name: jboss.container.jolokia
     version: "7"
+  - name: jboss.container.util.nss-wrapper
   - name: jboss.container.java.s2i.bash
   - name: jboss.container.maven
     version: "7.0.3.6"

openjdk18-openshift.yaml

@@ -45,6 +45,7 @@ modules:
     version: "7"
   - name: jboss.container.jolokia
     version: "7"
+  - name: jboss.container.util.nss-wrapper
   - name: jboss.container.java.s2i.bash
   - name: jboss.container.maven
     version: "7.0.3.6"

ubi8-openjdk-11.yaml

@@ -46,6 +46,7 @@ modules:
   - name: jboss.container.jolokia
   - name: jboss.container.maven
     version: "8.2.3.6"
+  - name: jboss.container.util.nss-wrapper
   - name: jboss.container.java.s2i.bash
   - name: jboss.container.java.singleton-jdk
 

ubi8-openjdk-8.yaml

@@ -46,6 +46,7 @@ modules:
   - name: jboss.container.jolokia
   - name: jboss.container.maven
     version: "8.2.3.6.8"
+  - name: jboss.container.util.nss-wrapper
   - name: jboss.container.java.s2i.bash
 
 help: