---
name: "nss_wrapper"
section: "1"
platform: "linux"
package: "libnss-wrapper"
version: "1.1.16-1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/nss_wrapper"
---

# nss\_wrapper(1)

A wrapper for the user, group and hosts NSS API

## NAME

nss\_wrapper - A wrapper for the user, group and hosts NSS API

## SYNOPSIS

LD\_PRELOAD=libnss\_wrapper.so NSS\_WRAPPER\_PASSWD=/path/to/passwd NSS\_WRAPPER\_GROUP=/path/to/group NSS\_WRAPPER\_HOSTS=/path/to/host **./myapplication**

## DESCRIPTION

There are projects which provide daemons needing to be able to create, modify and delete Unix users. Or just switch user ids to interact with the system e.g. a user space file server. To be able to test that you need the privilege to modify the passwd and groups file. With nss\_wrapper it is possible to define your own passwd and groups file which will be used by software to act correctly while under test.

If you have a client and server under test they normally use functions to resolve network names to addresses (dns) or vice versa. The nss\_wrappers allow you to create a hosts file to setup name resolution for the addresses you use with socket\_wrapper.

• Provides information for user and group accounts.

• Network name resolution using a hosts file.

• Loading and testing of NSS modules.

## LIMITATIONS

Some calls in nss\_wrapper will only work if uid\_wrapper is loaded and active. One of this functions is initgroups() which needs to run setgroups() to set the groups for the user. setgroups() is wrapped by uid\_wrapper.

## ENVIRONMENT VARIABLES

**NSS\_WRAPPER\_PASSWD**, **NSS\_WRAPPER\_GROUP**

For user and group accounts you need to create two files: *passwd* and *group*. The format of the passwd file we support is:

name:password:UID:GID:GECOS:directory:shell

The format of the group file we support is:

group\_name:password:GID:user\_list

They are also described in *man passwd.5* and *man group.5* on Linux. You can fill these files with made up accounts. You point nss\_wrapper to them using the two variables NSS\_WRAPPER\_PASSWD=/path/to/your/passwd and NSS\_WRAPPER\_GROUP=/path/to/your/group.

**NSS\_WRAPPER\_HOSTS**

If you also need to emulate network name resolution in your environment, especially with socket\_wrapper, you can write a hosts file. The format is described in *man 5 hosts*. Then you can point nss\_wrapper to your hosts file using: NSS\_WRAPPER\_HOSTS=/path/to/your/hosts

**NSS\_WRAPPER\_HOSTNAME**

If you need to return a hostname which is different from the one of your machine is using you can use: NSS\_WRAPPER\_HOSTNAME=test.example.org

**NSS\_WRAPPER\_MODULE\_SO\_PATH**, **NSS\_WRAPPER\_MODULE\_FN\_PREFIX**

If you have a project which also provides user and group information out of a database, you normally write your own nss modules. nss\_wrapper is able to load nss modules and ask them first before looking into the faked passwd and group file. To point nss\_wrapper to the module you can do that using NSS\_WRAPPER\_MODULE\_SO\_PATH=/path/to/libnss\_yourmodule.so. As each nss module has a special prefix like \_nss\_winbind\_getpwnam() you need to set the prefix too so nss\_wrapper can load the functions with NSS\_WRAPPER\_MODULE\_FN\_PREFIX=\<prefix\>.

For \_nss\_winbind\_getpwnam() this would be:

```
NSS_WRAPPER_MODULE_FN_PREFIX=winbind
```

**NSS\_WRAPPER\_DEBUGLEVEL**

If you need to see what is going on in nss\_wrapper itself or try to find a bug, you can enable logging support in nss\_wrapper if you built it with debug symbols.

• 0 = ERROR

• 1 = WARNING

• 2 = DEBUG

• 3 = TRACE

**NSS\_WRAPPER\_DISABLE\_DEEPBIND**

This allows you to disable deep binding in nss\_wrapper. This is useful for running valgrind tools or sanitizers like (address, undefined, thread).

## EXAMPLE

```
$ echo "bob:x:1000:1000:bob gecos:/home/test/bob:/bin/false" > passwd
$ echo "root:x:65534:65532:root gecos:/home/test/root:/bin/false" >> passwd
$ echo "users:x:1000:" > group
$ echo "root:x:65532:" >> group
$ LD_PRELOAD=libnss_wrapper.so NSS_WRAPPER_PASSWD=passwd \
  NSS_WRAPPER_GROUP=group getent passwd bob
bob:x:1000:1000:bob gecos:/home/test/bob:/bin/false
$ LD_PRELOAD=libnss_wrapper.so NSS_WRAPPER_HOSTNAME=test.example.org hostname
test.example.org
```

## AUTHOR

Samba Team