Phase 1 of 'Opt-in per-snap users/groups' (aka, the 'daemon' user)

[jdstrand]

@pedronis

global-ids: [ www, db ] : does not need a snap declaration

would global-ids: [<snap-name>] need a declaration?

If by <snap-name> you mean ‘apache’ or ‘mysql’, then yes (but that is what I put before, so maybe you meant something else?).

Sorry, my question was about the case where the requested user/group name matches the snap name, usually we think in terms of snaps owning that. But I was forgetting that here we also need to assign globally an id in the store to this, so my point is moot. If I understand correctly for the global ids case we need in the store somehow (how to be designed):

• keep a global mapping of these users/groups to ids
• allow single snaps use of some of those

The spec mentions that the store will indeed ‘keep a global mapping of these users/groups to ids’, but in the early phases snapd can maintain its list (eg, initially ‘daemon’, later the common ‘shared-users/global-ids’ (ie, www, db, etc)). The store is probably best involved when we start needing the snap-specific ‘shared-users/global-ids’ (ie, apache, mysql), ‘system-users/system-global-ids’ and ‘private-users/private-ids’, in part because we can have the most flexibility in maintaining them and any snap declarations.