Subject: Re: nsswitch vs ISC IRS
To: NetBSD Security Technical Discussion List <tech-security@NetBSD.ORG>
From: Jason Thorpe <thorpej@wasabisystems.com>
List: tech-security
Date: 09/13/2003 10:18:59
On Saturday, September 13, 2003, at 10:12  AM, Greg A. Woods wrote:

> [ On Saturday, September 13, 2003 at 00:01:21 (-0700), Jason Thorpe 
> wrote: ]
>> Subject: Re: BSD auth for NetBSD
>>
>> I think there's little chance of nsswitch being replaced by irs.
>
> Although I'm no big fan of supporting threaded code it would seem to me
> that something has to be done to "fix" nsswitch and I'm on the side of
> using something that already exists if it is well designed, even if it
> means changing internal system APIs a bit.  I don't know if IRS meets
> those criteria, but if I'm not mistaken some people seem to think it 
> does.

The changes to make nsswitch thread-safe have already been made by a 
3rd party, and will be integrated into NetBSD in the near future.

irs, while it does technically exist, requires a significant amount of 
effort even to integrate into the NetBSD system, much more effort than 
is required to apply the thread-safety fixes to nsswitch.  Even then, 
irs will not provide all of the functionality that our current nsswitch 
provides, and that is even before nsswitch gets support for dynamic 
loading of modules (changes that implement this are also available from 
a 3rd party).  irs would require a major overhaul to support dynamic 
loading of modules.

Furthermore, nsswitch is far more common in the Unix world than irs, 
and so nsswitch buys us a compatiblity-with-other-systems checkbox that 
irs does not.  (What OSs even ship with irs these days?  BSD/OS?  I 
can't think of any other OS that does, and BSD/OS is about to go the 
way of the dodo.)

         -- Jason R. Thorpe <thorpej@wasabisystems.com>