Re: [PATCH 1/1] rootless: always map nobody/nogroup as dedicated block

["'Jan Kiszka' via isar-users" <isar-users@googlegroups.com>]

On 20.08.26 17:10, Felix Moessbauer wrote:
> The nobody/nogroup ids were mapped as part of the linear id range,
> with an extra single-id mapping added only if the range was too small
> to contain them. The extra mapping was guarded by "uid_cnt < nobody_id",
> but the linear range ends at uid_cnt-2, so it covers nobody only for
> uid_cnt >= 65536. For a count of 65534 or 65535 neither the linear range
> nor the guard mapped nobody.
> 
> Relying on the linear range to cover nobody is unsafe in general. If that
> range covers the outer id that --map-root-user maps to, unshare punches a
> hole out of the mapping, and per unshare(1) this "may result in the
> highest user ID of the mapping not being mapped". That highest id is
> exactly nobody. This happens whenever the subid range overlaps the id of
> the calling user, e.g. with
> 
>   builder:0:65536
> 
> where the mapped block 1..65534 contains the builder's own uid. The
> resulting namespace then silently lacks a nobody mapping, while a range
> like 100000:65536 is unaffected and hides the problem.
> 
> Map nobody/nogroup as a separate block at the top of the range and cap
> the linear range at nobody_id-1. The separate block does not overlap
> --map-root-user, so it survives, and a hole now at most costs id 65533.
> 
> Fixes: 4fedb1ae ("add support for fully rootless builds")
> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
> ---
>  meta/classes-global/base.bbclass | 16 ++++++++++------
>  1 file changed, 10 insertions(+), 6 deletions(-)
> 
> diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass
> index f074eee6..c56b6b1a 100644
> --- a/meta/classes-global/base.bbclass
> +++ b/meta/classes-global/base.bbclass
> @@ -464,15 +464,19 @@ def run_privileged_cmd(d):
>          nobody_subid = uid_base + uid_cnt - 1
>          gid_base, gid_cnt = get_subid_range('/etc/subgid', d)
>          nogroup_subid = gid_base + gid_cnt - 1
> +        # nobody/nogroup need a dedicated block at the top of the range. As part
> +        # of the linear range they are lost whenever that range covers the outer
> +        # id of --map-root-user, because unshare then punches out a hole and
> +        # drops the highest id of the range.
> +        uid_linear_cnt = min(uid_cnt - 2, nobody_id - 1)
> +        gid_linear_cnt = min(gid_cnt - 2, nobody_id - 1)
>          cmd = 'unshare --mount --pid --uts --ipc --user' \
>                ' --kill-child' \
>                ' --setuid 0 --setgid 0 --fork' \
> -              f' --map-users  1:{uid_base+1}:{uid_cnt-2}' \
> -              f' --map-groups 1:{gid_base+1}:{gid_cnt-2}'
> -        if uid_cnt < nobody_id:
> -            cmd += f' --map-users  {nobody_id}:{nobody_subid}:1'
> -        if gid_cnt < nobody_id:
> -            cmd += f' --map-groups {nobody_id}:{nogroup_subid}:1'
> +              f' --map-users  1:{uid_base+1}:{uid_linear_cnt}' \
> +              f' --map-groups 1:{gid_base+1}:{gid_linear_cnt}' \
> +              f' --map-users  {nobody_id}:{nobody_subid}:1' \
> +              f' --map-groups {nobody_id}:{nogroup_subid}:1'
>          cmd += " --map-root-user"
>      else:
>          cmd = 'sudo -E'

What's the state of this? It blocks rootless CI in our gitlab.

Jan

-- 
Siemens AG, Foundational Technologies
Linux Expert Center

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/1e9ed609-1d0d-4e58-a44e-4708577c130c%40siemens.com.