From patchwork Thu Aug 20 15:10:29 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Felix Moessbauer X-Patchwork-Id: 5400 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 20 Aug 2026 17:10:50 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pj1-f57.google.com (mail-pj1-f57.google.com [209.85.216.57]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 67KFAnYU015254 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 20 Aug 2026 17:10:49 +0200 Received: by mail-pj1-f57.google.com with SMTP id 98e67ed59e1d1-38dd87656d3sf3081900a91.2 for ; Thu, 20 Aug 2026 08:10:49 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1787238643; cv=pass; d=google.com; s=arc-20260327; b=CGYRY8c1tw8Ba6p7lj9Xw6nVBsYdsGIMutd04IPW687Sa8i4vBSPK/G3CkpCsppb6Z kfFxqFadB/OzqGNA88n7SOZZM/fPzaxOBDq4Et2B5/+yglmbGov140ujG6UAdLO0VtPr Fk4pSMyITZkHcZn0G5WeWspm//0MfqS46igQqqKgS9P1htJCDnOgaUFkYDIF4VWlnqFF CO8soLknGiuH98jeXdZzzVgH3FmRwRl0MRytFP8MLglfjGWg3hB6fgFsOoAnshluaaaw GeQUZhrl8YvPXKQ6vSUXHN8Od5LM+lpovSAHNs26AY08ZZ2G0AppWqqIKCuehpAykAf/ zGEQ== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:message-id :date:subject:cc:to:from:dkim-signature; bh=BJ9KK8Lzm7vvanjykNC/69lik3lbAg5ZDQYwotY2vVw=; fh=6JRlBLfMQSoZjcbaMC5kYumru9e2y7OLO5VaZZTYGxk=; b=fHLu47jUatZpH3e9kRoHfBloCZW9laUjGEhNXeWXM8s5KBbCicDB8kOVMWtd6aBaVh GvBjBuuUfZHKkITBAejwUVk6P1vdHGm84AIuR57RtAjvULB4XH0SAmhIlhCVQgKa+JPX WEB1FfYa75ksZtWpk5XmJmXApFziFVx8wykf/VupuRbY32DshTUynWe4jhbbOZochxXx 2XGppoVFCpojwvWnvvwDqda5C4G0ycoPXmsU4zuv+pse2EchWWkekx2Yqj6UgRaDxhtd E2CuJP0cRM53X5d6YWVNVixo2w3Nf/Za8BW3V5jd84ar7YHcgV0PGdIECYrQq5zCjYXc iC6A==; darn=isar-build.org ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=bl3FhZJM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1787238643; x=1787843443; darn=isar-build.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=BJ9KK8Lzm7vvanjykNC/69lik3lbAg5ZDQYwotY2vVw=; b=sX/wjhKQDph2kpCckLd0i9ySeDD84vdl1fn2rGtwrke4T/7HzuFHieh2fKQ3oxzdsP Rm+7vUA2bGwBjOBUzYdi8W6SUX4pdceidMWJsT4Rg78o5gWOOridk7141X4Bs1d+VKxN wKY6MIQcmppk+PlOGpdXVWmqJ9M2HBqLYlEhVC+K5ViYfqBSds+9sON2B8213K5g/k47 Ad4ZIG+fcggWrcGXdT0Uzsl4aM9cuUOGv4Jmxruvq0dp/wmrVGbLdfadmXEEBm5mORhA Mr/UrAZmmMthgF0394cuJ9ajknz8DH6GR/HCoS1MniofbIAP5TKDlhwrpfTIW4XSENVE gdtg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787238643; x=1787843443; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:x-beenthere :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=BJ9KK8Lzm7vvanjykNC/69lik3lbAg5ZDQYwotY2vVw=; b=Ve5KTHOLxnM81XWWLO+FGdnxlzac/xH2QOGuSqCSUSReA/wByg9nP6tb1tW/jORpdn RruxUQc+dqUeufc78lS90MiY49IHxgY0QbCwhtClF64quWEm+bLksZKSp6KAhmHBBRMs NV+09LgLCymoIyqFCHNv33HSwfr5QUg5W7cjidcxPdzaerFpIOUONHtNpOOCbRs9zCmH mN2nITgyHGwJOfxXeW+IWp527S49oakSH9nXvRhu6KNEgrniE6NGNP0NcNW7gaKmwueN 9MXnbtzJgDtJkr8bOiHeyjbU/1NN/VWMDYzVd8Fl5YenHV74wgPpGL1Dcg3OngrYQBrI oIvQ== X-Forwarded-Encrypted: i=3; AHgh+RrQo5rHksX8FlyvCY0xHKFUSN59CCFvuHzUUcu5d4vrK5f16AvmvA7TkepRPWsjS4weimcn7t0=@isar-build.org X-Gm-Message-State: AFuF++m+ncRe0Z8wu1Ek7AklNRvAxPf/jqIQJHwvu+5S18KSTzpcZb+o 9WLHY4erR0ZzCoe6Eb+eeD8qF7oro9Ua3dSt/dBis837bejTqZRq0FR5 X-Received: by 2002:a17:90b:510b:b0:38e:b400:a860 with SMTP id 98e67ed59e1d1-395810e84bamr25987633a91.13.1787238642977; Thu, 20 Aug 2026 08:10:42 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdet67LpzE35kquQJi+/OnhJ+7kxYWTB2o02S4EXQcl6Jg==" Received: by 2002:a17:90b:6cb:b0:37e:24af:2277 with SMTP id 98e67ed59e1d1-395a0860338ls1860819a91.1.-pod-prod-06-us; Thu, 20 Aug 2026 08:10:40 -0700 (PDT) X-Received: by 2002:a17:90b:1804:b0:38f:dec8:f7e9 with SMTP id 98e67ed59e1d1-395810b5a15mr23928582a91.12.1787238640632; Thu, 20 Aug 2026 08:10:40 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1787238640; cv=pass; d=google.com; s=arc-20260327; b=CNhl+CZybCID0moidrLpLg2U6JwOQi4Rv7GrTUPEDr8/3irQmegbs6Yygp6qUJdZ1y uQpOkeBM3JXEKHIgG7m58ZBHeMSr5R6icynAUm6ZNj+WcbmISM6IuwyC4BxFzt9+heD1 8avMeI8/clcvxWRWLs5SL1UKX7V89as6XZ07S3xgB0YRji+qW5CcW6u2C2pDpVQaTlVr 5jWWT2hqrvXXxafpVnYNCMDvfwKfQPgGYbQbTosaboQwoPjBnGVyDvvDP6VptM3iCsvb ABkRUr96C9/1/9y6Gpnf7fbHpyFIRO5VCG4/vE5EwYTxxYGPmeC4JSUhwiR7VIEYaCuq 7qMA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:dkim-signature; bh=G6fFvGBPoX/r5HqcKEez633yvtA1llw0aSfnGC3ntvM=; fh=akEDxqCx8SXNfng4/80otlrEVebDroEzjSeLu6ZY87w=; b=mZOC1OzIwZiMIHKOFKa/E5NbqhpU7JjkN+/xQxBxPR932gx49yMdZ6znIbT86a2bGz +03XI0YK8FvRQbs7vjj4u8f85aXzsZfoi3vnsz+DtfY6I5QCEsLTGQ6RTD+ca6OvM4fA LydMhTkhn7Fdcnf/QMFsB/2qHGeVOQT6UqLO9wWoZHYMYWUMJa2WkcKlvyLYgaDgBNMs +3b9YnCxpnFEzM19BUC9aWMWlTTBSC7jJDnsmMy19HuFkfg+9yQBBz+iINApUzlEoUXZ 9opXjz/Jh4Qdla3Tsyz6mlCYE4K3l9jqvmi7x8bbHcjt/BJ2A5ToCIpy8+EHogaEflhw WQ8w==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=bl3FhZJM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazlp170130006.outbound.protection.outlook.com. [2a01:111:f403:c201::6]) by gmr-mx.google.com with ESMTPS id 98e67ed59e1d1-395a9c0e996si58424a91.0.2026.08.20.08.10.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 08:10:40 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) client-ip=2a01:111:f403:c201::6; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=pxf3YQlHCrmTI3x9MUZyjvM2S1CdADTlgP7I0rnnL6duEW3U4FHECI44dRuZMou4AInsYOv8iIVSCiOSpBwZJn3SarII5h+P+5tHJGI6af5Lzc/2yQXTO55wuCUUCbzhhzZePL/WvRhiUvX7ppGL6S4JasS9Z4pPv8nLdFagJNa/bxb+5IVlV7dVQgRkMgKY1zdS/GjQD/Vt0H8PoWD6fbFNEXrgT+eAbUSC7/2CWKyyxlRKVXDaMErdLrLTrkI1gXQeHO/KlyaeLYRMT2J2A+NXn6jTVTbTNZAQn9GpTmOBvE0NUaF/AFHVOFymC1WR/C6nm4YGQG5ww80TeGKz4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=G6fFvGBPoX/r5HqcKEez633yvtA1llw0aSfnGC3ntvM=; b=EwhJVGJjjzHDbn6aeo6fH70UkwTk7lw7CbGP0McJEVqUtpzIQo4CWt9NVyKGoqxLTdkwlkAPtIWg3AecQOb089KwLdCIMzNm/FJRWivkwENqJdha6v0DwZwzzYa534aXqt8Q5By2shA271DubKL2rDHnT3RQqoeBCHW4CmuWfBvcxSiWe1SlVzhAfYU/pgrI+cZjF+uwTS91lW8qHvFee3oQiRZuuayma46jUdC8DxqX7uiyjWGc79SMXgYA+Y0FkjkP3MOGEHIweP0m+X0KhPK74fMN0LNwOTZshYg4Bh05M5auHuKviPHPn0gZ2txWbcrxBI98LkNGI8BlFDt8RQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:800:14a::21) by PA1PR10MB8869.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:440::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 15:10:37 +0000 Received: from VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM ([fe80::4985:cc3c:fb41:6886]) by VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM ([fe80::4985:cc3c:fb41:6886%5]) with mapi id 15.21.0339.007; Thu, 20 Aug 2026 15:10:37 +0000 X-Patchwork-Original-From: "'Felix Moessbauer' via isar-users" From: Felix Moessbauer To: isar-users@googlegroups.com Cc: jan.kiszka@siemens.com, michael.adler@siemens.com, Felix Moessbauer Subject: [PATCH 1/1] rootless: always map nobody/nogroup as dedicated block Date: Thu, 20 Aug 2026 17:10:29 +0200 Message-ID: <20260820151029.802935-1-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.55.0 X-ClientProxiedBy: FR4P281CA0059.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:cc::7) To VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:800:14a::21) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VE1PR10MB3967:EE_|PA1PR10MB8869:EE_ X-MS-Office365-Filtering-Correlation-Id: 5c2c7d60-a2c5-4381-9ad5-08defecd30b1 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|10070799003|376014|10067099003|56012099006|11063799006|55112099003|18002099003; X-Microsoft-Antispam-Message-Info: JIYAdGTk8mZG8zfKEZHav8JDVu3qf2ubFJR+b/wazssVGezmfxRb+YMTbspzHt7r7NHU3wZYRT4GXxnxtatQdnBLAM1mfl1FWSS76Z/GzHgXih8cXuJLB7THhgOiXedvFbK20CkgeLDEdkaa5+WWboFiiR/6o1rdV9g44UECYMnBEr0xNVoG4wnMZDMGBD3O3EVK/yPFZUAS9SbikeQtAtaAxcBz63K3s5qt1U+GTntXha4s7xFB/0ARSm9N+aa3l2OKH1tD9nV0M/Oh0cnLh4I0+KhFGe+nNbKqD2+2ooNeEpA5fj2uk2YA/L7S0pKpyF8Mx+GwnJhoGE7qctzWZY+4dMIdTLfDMlpK7RIMhvRkwGqxobY9q3mGDN0/rYq1grqHol55OLnHWbl0Kx4Hdkjc9RwI2ioJXTme981iwB1nb9id27pXn44ogEOmzOsk4XGDIejb8RhG5JNOoKdmKC20744DwJ+JZINmw4k8gw1p9Hnn/Y4AzIvFlGeg9gVzVs8dlZF/SLkIyj8uRFr8Qj89cr2QjGIwVmTYJauTEd3+vfxqt7sneC/nnw2PV+Oshyqy48nhIg5nuPjaHKoj1geRpdlDHGOjj80SZkSsS8YEICTwSWySGb2VwtZt1ixTtSiGXTf/5n39wbuv3qZnVeCCkws4eii3v9uorOrz1xA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(10070799003)(376014)(10067099003)(56012099006)(11063799006)(55112099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: 0sCNHYR/Svtn/Mpk+US5yj4+akpK9EhxS/bFJkA7CM/MKDeElM0RqDsAMI2Q9JrvdtzgYnSO4SMQjjZdRUzxWPgqy3sqigCxHzt+6HY5mDM2edSWMD9Ig3XLfVXzBtgnBQcy0ZSeBFW42hne2kRX3aWleTjLCT1mHBg/E3uHjA6P8oi0kQlvsJg1XqDRLv1tm9Oz+mMR4SEsD3JnwbLVdGQ5S2TIZyw3nvaaIcaO6k2zORnlfyJRBfgtSJo5TqJWRsMKm9OUT3+2OvHdzGegvNEfsodgwxhJxSQhio2IP6tI+PvXvGR0bpze86TTAm1R1067v1LL5c6KEkmjMbfDbjvIRtQtNXwWV0yadbMzlChQM52ul8H0q/x06k4TyMsBB70hy1i+/vzE19t4ZOb/Q1IsFgmBFByt1AzK6nw0Rt/JQ5brpRpJZ59+bMxgsZVoJHFT9DUiIK14u6vmpKZ0M0tg5sGKDU98qnhf0BhqgpWy+wtw97NgsZlBAESJ8wXWI08MlkYBepcdtzkxVT/TEqL1A6zPA0QBMiJG1f0wsfOpvv+4hPKHwgBVZMyob0K0Flr/+dU9OtIoL6IChw14isZxVx0DKP0vMniSGEK412urrzbUF72pV/jnJ/p9ESIExBKemzYHjDQkJ7t6cJlcc/hq274Spu+TZglEWC04W9/m17XKOrPxfij2H6720F2fY3FH8/SobWDR472Qvkx22ApjIAeqWifXP5OELUgDxYcSXrOmatmcwtbTp+5fMhYaEpBc+xQxDMLVg0bU0fLStEwh3mMhRaRO0c8rqSi4CPl1PtXLL0VMmlDmYX+VFVjTowcU0lAmmSGNQtPg3A6woNVda75QksoOMT8MIQBHhB4O70Htl3cgP0ejR+zjPTc12JyMmy2s54ssazCnqh95oGf+RsHRij/Aaaliw+SUydH/QfGZ4PjmJedC6FuKxtv92QtIEQbQLa9qPAYn+cRe5KsyzoM7st7ZI1gxYq8oCcVu5W1DzjU+wQqaNo6keDAKyGnQcOyIxCB020wuaUvnRyTcrC+YT4HXSye9J1IOFzlYAipczb2NFn+vuCCxhoGgGiTT1e8TF/P/OSLoSujWpD4JdbBz/K1y+kWXYFV3pDjfY/Wp3ELZ0bCa3CRLVrEmw4DcRNqSKSS1CvjFEu7W23pCVGDIqD2UYfk3QAQ7AsVJIb0YFnyk0uyzFXjcufOnkTuDP6cbd4xSyuwIrfeKsipZPudfKQMt4RLCg+ePDHSiJl6z1KHNkipLtqWTIPfJsdBWKLtAlNbByo5ih1RoQwlq94DgkB6fvunMXhw1O0tXJ0pmllG+rHtzsecREkEUQamaGENWTkySOW4j/KxDW/Nj98MPjIGiUvzckO+79bAtls6xNowP0dkvNaDq1g1H5CRP2YK714mZhsEZVELEtPGuua02oJXtrsBn0diDILV4KxQkHjIRX8zvl/qpwq54ohbWONtxPRhRCsyY8EW0EXCk0drDkEnauNfWaN7HcdSSsqbDm15OuLJLBcLtENExUWucJqH2vxc3Yv4gsZLMfs24iORJ9PlF9KjnemPPXx8FEumbaCL3V/aEb3bkGbKnqUkGPQluzVFO5Rn7c8p1FFhWj0yfhL/za0qDcUoeNH7A7vGuAv23CDxSzm+lRYjDZ0xNo6KZYwoq9/hvIGuDw0WKZ6WeenqsP8JfxH8JIZsJ/+WQMvF2mfqbJmVtr7nkHeTyVRHwvomqXCzJ0pFjR5mHvT+wRz4bFkxp8ckwl1Abe9ifIBhLmtKxCSksF4je7znPCHck X-MS-Exchange-AntiSpam-MessageData-1: Wx+eJvT2jTmi2UwanXCHZ3dzFp0hpbqMUBY= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5c2c7d60-a2c5-4381-9ad5-08defecd30b1 X-MS-Exchange-CrossTenant-AuthSource: VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2026 15:10:37.3259 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Pg6ng5vb0T2g2STMnD7xXaXtEJNlW9FycdRIqD1ZaoM1X5guaDO7QfXQ+p3Mr5AkrssNopX1v5iIBhZ5HDPhnYCpJRR+OKgldMZRuqaTLR4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1PR10MB8869 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=bl3FhZJM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= The nobody/nogroup ids were mapped as part of the linear id range, with an extra single-id mapping added only if the range was too small to contain them. The extra mapping was guarded by "uid_cnt < nobody_id", but the linear range ends at uid_cnt-2, so it covers nobody only for uid_cnt >= 65536. For a count of 65534 or 65535 neither the linear range nor the guard mapped nobody. Relying on the linear range to cover nobody is unsafe in general. If that range covers the outer id that --map-root-user maps to, unshare punches a hole out of the mapping, and per unshare(1) this "may result in the highest user ID of the mapping not being mapped". That highest id is exactly nobody. This happens whenever the subid range overlaps the id of the calling user, e.g. with builder:0:65536 where the mapped block 1..65534 contains the builder's own uid. The resulting namespace then silently lacks a nobody mapping, while a range like 100000:65536 is unaffected and hides the problem. Map nobody/nogroup as a separate block at the top of the range and cap the linear range at nobody_id-1. The separate block does not overlap --map-root-user, so it survives, and a hole now at most costs id 65533. Fixes: 4fedb1ae ("add support for fully rootless builds") Signed-off-by: Felix Moessbauer --- meta/classes-global/base.bbclass | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass index f074eee6..c56b6b1a 100644 --- a/meta/classes-global/base.bbclass +++ b/meta/classes-global/base.bbclass @@ -464,15 +464,19 @@ def run_privileged_cmd(d): nobody_subid = uid_base + uid_cnt - 1 gid_base, gid_cnt = get_subid_range('/etc/subgid', d) nogroup_subid = gid_base + gid_cnt - 1 + # nobody/nogroup need a dedicated block at the top of the range. As part + # of the linear range they are lost whenever that range covers the outer + # id of --map-root-user, because unshare then punches out a hole and + # drops the highest id of the range. + uid_linear_cnt = min(uid_cnt - 2, nobody_id - 1) + gid_linear_cnt = min(gid_cnt - 2, nobody_id - 1) cmd = 'unshare --mount --pid --uts --ipc --user' \ ' --kill-child' \ ' --setuid 0 --setgid 0 --fork' \ - f' --map-users 1:{uid_base+1}:{uid_cnt-2}' \ - f' --map-groups 1:{gid_base+1}:{gid_cnt-2}' - if uid_cnt < nobody_id: - cmd += f' --map-users {nobody_id}:{nobody_subid}:1' - if gid_cnt < nobody_id: - cmd += f' --map-groups {nobody_id}:{nogroup_subid}:1' + f' --map-users 1:{uid_base+1}:{uid_linear_cnt}' \ + f' --map-groups 1:{gid_base+1}:{gid_linear_cnt}' \ + f' --map-users {nobody_id}:{nobody_subid}:1' \ + f' --map-groups {nobody_id}:{nogroup_subid}:1' cmd += " --map-root-user" else: cmd = 'sudo -E'