On So, 06.09.26 16:56, Skye Soss ([email protected]) wrote:

> While the systemd project encourages the use of systemd-nsresourced for 
> creating uids and gids for containers,
> many users also rely on the sub{u,g}id system (new{u,g}idmap, getsubids, 
> /etc/sub{u,g}id).
> This is important for more than just container managers: to delete a file in 
> a user's home directory,
> one might need to enter into a user namespace to have the proper permissions 
> (ex. via `podman unshare`).
>
> This is also true with the foreign uid system that systemd introduced, where 
> a user may need to enter
> into a user namespace to delete files owned by the foreign uid range in their 
> current directory.
> For reference, that looks something like:
>
> $ unshare --user /bin/sh
> sh$ varlinkctl call --push-fd /proc/self/ns/user \
>     /run/systemd/io.systemd.NamespaceResource \
>     io.systemd.NamespaceResource.AllocateUserRange \
>     
> '{"name":"ns-1234","size":1,"target":0,"userNamespaceFileDescriptor":0,"type":"self","mapForeign":true}'
> sh$ rm -rf ./dir-owned-by-foreign-ids
>
> The issue is that, right now, it is impossible to do both at the same time: 
> enter into an unprivileged
> user namespace with all of shadow-utils's subuids and subgids mapped (like 
> podman unshare does) *and*
> also map the foreign uid range. The /proc/$pid/uid_map file can only be 
> written to once, so a single
> privileged service must understand both subids and foreign ids at
> the same time.

Huh, what's the usecase for this? why would you want to combine that?
i don't get it?

I'd normally expect people to either use subuids and the stuff that
comes with it, or uses nsresoured stuff, but i fail to see why you'd
want both for the same container?

Lennart

--
Lennart Poettering, Berlin

Reply via email to