Files
systemd/man
Luca Boccassi 6dfd290031 core: Add PrivateUsers=full (#35183)
Recently, PrivateUsers=identity was added to support mapping the first
65536 UIDs/GIDs from parent to the child namespace and mapping the other
UID/GIDs to the nobody user.

However, there are use cases where users have UIDs/GIDs > 65536 and need
to do a similar identity mapping. Moreover, in some of those cases,
users want a full identity mapping from 0 -> UID_MAX.

To support this, we add PrivateUsers=full that does identity mapping for
all available UID/GIDs.

Note to differentiate ourselves from the init user namespace, we need to
set up the uid_map/gid_map like:
```
0 0 1
1 1 UINT32_MAX - 1
```

as the init user namedspace uses `0 0 UINT32_MAX` and some applications
- like systemd itself - determine if its a non-init user namespace based
on uid_map/gid_map files.

Note systemd will remove this heuristic in running_in_userns() in
version 258 (https://github.com/systemd/systemd/pull/35382) and uses
namespace inode. But some users may be running a container image with
older systemd < 258 so we keep this hack until version 259 for version
N-1 compatibility.

In addition to mapping the whole UID/GID space, we also set
/proc/pid/setgroups to "allow". While we usually set "deny" to avoid
security issues with dropping supplementary groups
(https://lwn.net/Articles/626665/), this ends up breaking dbus-broker
when running /sbin/init in full OS containers.

Fixes: #35168
Fixes: #35425
2024-12-13 12:25:13 +00:00
..
2023-12-25 09:15:53 +01:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-26 17:28:14 +01:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-26 17:28:14 +01:00
2024-11-06 19:06:47 +09:00
2023-12-26 08:59:53 +01:00
2023-12-26 08:59:53 +01:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2023-12-26 13:10:36 +01:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2023-12-24 09:32:26 +01:00
2023-12-24 10:46:55 +01:00
2024-11-06 19:06:40 +09:00
2024-11-24 01:11:42 +09:00
2024-11-24 01:11:42 +09:00
2024-11-05 19:32:19 +00:00
2024-10-24 09:54:48 +02:00
2024-11-18 15:18:26 +09:00