On So, 06.09.26 16:56, Skye Soss ([email protected]) wrote: > While the systemd project encourages the use of systemd-nsresourced for > creating uids and gids for containers, > many users also rely on the sub{u,g}id system (new{u,g}idmap, getsubids, > /etc/sub{u,g}id). > This is important for more than just container managers: to delete a file in > a user's home directory, > one might need to enter into a user namespace to have the proper permissions > (ex. via `podman unshare`). > > This is also true with the foreign uid system that systemd introduced, where > a user may need to enter > into a user namespace to delete files owned by the foreign uid range in their > current directory. > For reference, that looks something like: > > $ unshare --user /bin/sh > sh$ varlinkctl call --push-fd /proc/self/ns/user \ > /run/systemd/io.systemd.NamespaceResource \ > io.systemd.NamespaceResource.AllocateUserRange \ > > '{"name":"ns-1234","size":1,"target":0,"userNamespaceFileDescriptor":0,"type":"self","mapForeign":true}' > sh$ rm -rf ./dir-owned-by-foreign-ids > > The issue is that, right now, it is impossible to do both at the same time: > enter into an unprivileged > user namespace with all of shadow-utils's subuids and subgids mapped (like > podman unshare does) *and* > also map the foreign uid range. The /proc/$pid/uid_map file can only be > written to once, so a single > privileged service must understand both subids and foreign ids at > the same time.
Huh, what's the usecase for this? why would you want to combine that? i don't get it? I'd normally expect people to either use subuids and the stuff that comes with it, or uses nsresoured stuff, but i fail to see why you'd want both for the same container? Lennart -- Lennart Poettering, Berlin
