From b17f8cd9cc34653dada90ed2cf7fc95936f11aad Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@amutable.com>
Date: Sat, 10 Oct 2026 23:46:55 +0200
Subject: [PATCH] man: explicitly say the NSS is not OK in generators

Inspired by: #44112

(cherry picked from commit 54b24a3855de37e5e19235c44acd113eb6ce6830)
---
 man/systemd.generator.xml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/man/systemd.generator.xml b/man/systemd.generator.xml
index f39c073378..7e7404e4ec 100644
--- a/man/systemd.generator.xml
+++ b/man/systemd.generator.xml
@@ -259,8 +259,10 @@
       <listitem>
         <para>Generators are run very early at boot and cannot rely on any external services. They may not
         talk to any other process. That includes simple things such as logging to <citerefentry
-        project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>, or
-        <command>systemd</command> itself (this means: no
+        project='man-pages'><refentrytitle>syslog</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+        <citerefentry
+        project='man-pages'><refentrytitle>nss</refentrytitle><manvolnum>5</manvolnum></citerefentry> calls
+        such as <function>getpwnam()</function>, or IPC calls to <command>systemd</command> itself (this means: no
         <citerefentry><refentrytitle>systemctl</refentrytitle><manvolnum>1</manvolnum></citerefentry>)!
         Non-essential file systems like <filename>/var/</filename> and <filename>/home/</filename> are
         mounted after generators have run. Generators can however rely on the most basic kernel functionality