From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Wed, 26 Aug 2026 08:49:04 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-oi1-f183.google.com (mail-oi1-f183.google.com [209.85.167.183]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 67Q6n2Mx018029 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Wed, 26 Aug 2026 08:49:03 +0200 Received: by mail-oi1-f183.google.com with SMTP id 5614622812f47-4b1bd347d5fsf1193374b6e.3 for ; Tue, 25 Aug 2026 23:49:03 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1787726937; cv=pass; d=google.com; s=arc-20260327; b=S6yETk0NmvUEK9cn42EVJkaTw8FVoENJSwGWyGIBIgNvkcz/Rx1SyR6FhCEmmb543F F3LMw7njMiEtLtLRSfo8CkdeqpvEmSYm0WD1VeSwuyZP8ZW59UM9IMeKNlIlyonesS5j sL0fD1u4sD9/niJecMNrAIpA9Ir0QDUhzNEztjErLgDHUAc0lPVIEBjJjRD8mSn7MYsy t3KkfC9tilWy19DUuMF/NsVrX962bnXC5fXkSZF5XWLJz5VhJXmhHic6B1VVwHtEDHRt Um274PE2gAoBdD2TSdiu6FtU3KZglJI/YmA7Hpil8FzhTMbsguf5Khd0A2+nBLyOgDpD vjVA== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:in-reply-to :autocrypt:content-language:from:references:cc:to:subject:user-agent :date:message-id:dkim-signature; bh=1rphICdRyAyW0QtqwlUcWnhAIZ9dJ3SROcZeZicT0Ps=; fh=nTRTxkgEgH3uP6bu23EpfvPyd8ifdNrPG1wl/wqt81k=; b=QF8De1foHkpXwvxyY2Be9Usj4T9DfupJDYQNgrBi8BPDBZWxUB6PLOMzfbXS2KPK4V olNGgZJO4J+y6ffCdTEDQxkqnDdgUE3XLFJL1Qxg36IGGT2QSzzP69IZtQ5A/YF+HdqU mOBEMsZfTGzNKuQjiIvCDCg2awPU6avblmUSzAw71H5+nq/SSRL3HPuAksdp1bigTxFv WBecnAci4YMQBOc1XBWe4p5ZV+gyF0OHTbAPENS3B9Q5D2cOW0f3rpgDSOxxAkiLCGFn cvZ6x9NcNRE3v+AOnxIPUHLmHKgh6lR8mzmJb73gt6BvuUoPH/L2Y5BlJ3mBPTTHfQG3 hVXA==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=ru2gkO98; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of jan.kiszka@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=jan.kiszka@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1787726937; x=1788331737; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:in-reply-to:autocrypt:content-language:from:references :cc:to:subject:user-agent:date:message-id:from:to:cc:subject:date :message-id:reply-to:content-type; bh=1rphICdRyAyW0QtqwlUcWnhAIZ9dJ3SROcZeZicT0Ps=; b=MoAssSBQSCktgTkjjBqrhmFiemIVtJkeT8unnGLVUA1biNLAIZ8Hq1hKbbBvvj8QRv MDpZ7G3RSAOSumMBFe30M/JqOZKOQ81IXH8JpXIoNerwtfFwEYvAyiN8m6mvQ8/LeX4W GLCwD6iOQGnsCC8AMjbTH6unMokc6nyTJKGCq6MHc3/Dc8CDSC2NyN+2FbokZ/2riiGS 0kDj+zdHTCCcWqtCt0shxewUMrkPWK+VCMdOwPDyUGbZqtASVpZ8s5QUIYfbhAmHYO8F jbUHMjN4rotqkary5XZhBlrCCkx6MTyQXvoF9N2rL288DPwvtlLOwWtEvzQ7p12i6oJx nuWw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787726937; x=1788331737; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:in-reply-to:autocrypt:content-language:from:references :cc:to:subject:user-agent:date:message-id:x-beenthere :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=1rphICdRyAyW0QtqwlUcWnhAIZ9dJ3SROcZeZicT0Ps=; b=GsRg2OPiu85aFBLUdbXau2l49PmrGBHOph5MJf5yu6pa/PCyG026KSwceH7Gyo5Iqy 6DkR1WlJO0OAntrcsyuqOMtnEiiFbbQj3AqgzI4IK1U1lb1fpBUvHrJzQQgWNLZZ26Q4 DtHzWQV6WERkTAts6ssV68xqA7uVvQHoz1yOvecEIXqguL4Po/YhFulfhI8I5uG1Ec77 aeCj/r9PgcNHqM+bBGIBsZxibTFLxNkoxGIaQZP1fnANUW3fcx/pvqesdbdcaQsZy9Dx ek6uRaIIOERwmHa7tTPXdDxP/uNg9StZrC15U2e2/FSBJtzNWUUR6rTqfzjSVALFSwep Dabg== X-Forwarded-Encrypted: i=3; AHgh+RoTuSaPFqpT2Two4mosebrA8ltATlw5ChGAzhcvcyGwfRtOhRT2o2pPFxMYSf0Z9wd+dOS2@ilbers.de X-Gm-Message-State: AFuF++mMVa/BzO4IOQq2ggzTYzrB13nXWh7b8ZuGLQtqAWDAv7KISe+d ki+Y//YUKTPJqCDmyQFil8m8yGJ50Uv+K7tmBPAkrF3mO1NhUdRagWnY X-Received: by 2002:a05:6808:15a1:b0:4b3:2274:247a with SMTP id 5614622812f47-4b366a8ecb1mr5085076b6e.11.1787726936598; Tue, 25 Aug 2026 23:48:56 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdfxIqgsH/Cu+AM3QXIETFtc0MrV+cITMACDBU7+JTBgxw==" Received: by 2002:a05:6870:8269:b0:45e:ed3d:358b with SMTP id 586e51a60fabf-463d91deecals2802204fac.1.-pod-prod-02-us; Tue, 25 Aug 2026 23:48:55 -0700 (PDT) X-Forwarded-Encrypted: i=3; AHgh+RqXHQJ1hZJeLwHbzQiiYuonYb/ZNzmoZjsnU1BWdjKOTbYtSXVZK62S5ERk172QTNC5ytTzWGWSPHKx@googlegroups.com X-Received: by 2002:a05:6871:360c:b0:457:b657:b084 with SMTP id 586e51a60fabf-4659a8ee93bmr5109001fac.18.1787726935695; Tue, 25 Aug 2026 23:48:55 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1787726935; cv=pass; d=google.com; s=arc-20260327; b=VzcKXhAHjZCGuUVG0NLBMV5L1hXJ8gDCzzvus0Hiieb6jv4S7dBZeyIwUHdlH+4919 By4G7hcVvpWPA+tjNK1Bh8/c90E+EFX5HFaa7Fa7VDHdS5SsVfpsCkYm1IHSjLvXSPIX LGXbzB8UUX8NZqgwS7BVDfBStn1Z24nipS53qxY7VHliZ+ZIpZmxlj7W7YHV9rdpLzXU vQvyF0Jw/bHPW4jXl8IIoonkay4vkixraqtRGrajlKeZf9bj6T6eLlT1DPRWOg1hE+aW 7KaNHUUGBOFTmlUizguzZ+d+55jqAx1iEIyjmmmNT23b+mhhcBjYZ/cegAtO8O/odz8R u9/g== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:in-reply-to:autocrypt :content-language:from:references:cc:to:subject:user-agent:date :message-id:dkim-signature; bh=p3YPmFnlajwPoCZ1ssxhlIrGl6e6oivK6zxFGP+3swk=; fh=eGEh3/ZD9NDTRmVTz+qqCWq5BAVzY3n5oPlWoRMyNA0=; b=DKiO4cpzzdgLshYFVoWHLVMD3hvHyzUPwB6CkLTb4lXTBbyU1t2AMTeoe1yUKPxvpc 38zQtP5miBpqn4k9N2Yu0To35gS+dFNNh8d4Atja9mdUlQDVdTm5vC2mV36y5rZMQPOA xq9nCn6vCwIMkn9uIYKA/90nSVREjdkIAPNDVSJLjCDR18MgxMzzbQoEfa4/RZG16/kk Xc26/+sBs8Oo5d1yqFSyZzwJpvjdcC2p4Kfl3D/KVT2d17NSRUNaxe6BBGpp7pHEzczO zQB7BC/B2tFs1L+U/HoqDCNT+tPOi315qaSInuJ2cI4XSQ3ZlOgSo3lmng3zRgamuMDa ssGw==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=ru2gkO98; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of jan.kiszka@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=jan.kiszka@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazlp170110003.outbound.protection.outlook.com. [2a01:111:f403:c201::3]) by gmr-mx.google.com with ESMTPS id 586e51a60fabf-465ad9f3766si52738fac.2.2026.08.25.23.48.55 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 23:48:55 -0700 (PDT) Received-SPF: pass (google.com: domain of jan.kiszka@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) client-ip=2a01:111:f403:c201::3; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=dSV67WLhwa/9yGAjs9ZIERbKJQIWWi14EhMwQeoYA3y1caYvj3io00IQ8Lemy/adPCT5097xsgLL3CHCU0L554Yjvlc24+dF6/bk0bFr1UvL3dYsg8vC/1kUyVpvptiI/8PXLmJFqbctmK+uobfUHmke4dRurSC1zF4erHICtJ3FG0x32Bd8uMOcPt2C7PbIrVzzbNAXhURyRviPK2KV7v3K6RSuA5bT3gXmKkuMEUWUjnz/OGvUooK7xriha/iy7fFXAjkKoaVZKKwANE4A52k5Wm/fW2oWBUYXxZhQvIcMYb3JPT+WO4TWV98Xq9kP0UbjRq3oOdfZdLjsDyU2TA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=p3YPmFnlajwPoCZ1ssxhlIrGl6e6oivK6zxFGP+3swk=; b=sB/hTj/COcCUYjoCbkpqsXiyW3sMzMMelN8KMxDCZKHPmGFFYfJiNQrezmmTimJ3I/bIlGsIeF7XLg/0jLlec08z4qITaIW/lbBLVmC4zd4QervfCfEfJQUOhZu2znb0p/R4bYFlVHsI2rDPyOk+XcAgL2VTWkE/dbIoJ8KJQMxgHIVDhiIX8H9wJnGifrufDxRCQoZ6IasARIBvpJ/Go3Vu1XqzgCSvO4c1kHJu3ePEIx5ecvOawT5iunkZj70wejmyUHD9yC1Sciv3SlStiIpy6W+fb0ZbcMNWqXf0Xs6pQKkTx4/V/cNU5qa9CsoGikmxPxHmOPSC02OHDpG/3A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from AS4PR10MB6181.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:588::19) by PAVPR10MB7403.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:31f::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.360.8; Wed, 26 Aug 2026 06:48:52 +0000 Received: from AS4PR10MB6181.EURPRD10.PROD.OUTLOOK.COM ([fe80::be9f:e8ca:ee9:83e1]) by AS4PR10MB6181.EURPRD10.PROD.OUTLOOK.COM ([fe80::be9f:e8ca:ee9:83e1%2]) with mapi id 15.21.0360.006; Wed, 26 Aug 2026 06:48:50 +0000 Message-ID: <1e9ed609-1d0d-4e58-a44e-4708577c130c@siemens.com> Date: Wed, 26 Aug 2026 08:48:49 +0200 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/1] rootless: always map nobody/nogroup as dedicated block To: Felix Moessbauer , isar-users@googlegroups.com, Zhihang Wei Cc: michael.adler@siemens.com References: <20260820151029.802935-1-felix.moessbauer@siemens.com> From: "'Jan Kiszka' via isar-users" Content-Language: en-US Autocrypt: addr=jan.kiszka@siemens.com; keydata= xsFNBGZY+hkBEACkdtFD81AUVtTVX+UEiUFs7ZQPQsdFpzVmr6R3D059f+lzr4Mlg6KKAcNZ uNUqthIkgLGWzKugodvkcCK8Wbyw+1vxcl4Lw56WezLsOTfu7oi7Z0vp1XkrLcM0tofTbClW xMA964mgUlBT2m/J/ybZd945D0wU57k/smGzDAxkpJgHBrYE/iJWcu46jkGZaLjK4xcMoBWB I6hW9Njxx3Ek0fpLO3876bszc8KjcHOulKreK+ezyJ01Hvbx85s68XWN6N2ulLGtk7E/sXlb 79hylHy5QuU9mZdsRjjRGJb0H9Buzfuz0XrcwOTMJq7e7fbN0QakjivAXsmXim+s5dlKlZjr L3ILWte4ah7cGgqc06nFb5jOhnGnZwnKJlpuod3pc/BFaFGtVHvyoRgxJ9tmDZnjzMfu8YrA +MVv6muwbHnEAeh/f8e9O+oeouqTBzgcaWTq81IyS56/UD6U5GHet9Pz1MB15nnzVcyZXIoC roIhgCUkcl+5m2Z9G56bkiUcFq0IcACzjcRPWvwA09ZbRHXAK/ao/+vPAIMnU6OTx3ejsbHn oh6VpHD3tucIt+xA4/l3LlkZMt5FZjFdkZUuAVU6kBAwElNBCYcrrLYZBRkSGPGDGYZmXAW/ VkNUVTJkRg6MGIeqZmpeoaV2xaIGHBSTDX8+b0c0hT/Bgzjv8QARAQABzSNKYW4gS2lzemth IDxqYW4ua2lzemthQHNpZW1lbnMuY29tPsLBlAQTAQoAPhYhBABMZH11cs99cr20+2mdhQqf QXvYBQJmWPvXAhsDBQkFo5qABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEGmdhQqfQXvY zPAP/jGiVJ2VgPcRWt2P8FbByfrJJAPCsos+SZpncRi7tl9yTEpS+t57h7myEKPdB3L+kxzg K3dt1UhYp4FeIHA3jpJYaFvD7kNZJZ1cU55QXrJI3xu/xfB6VhCs+VAUlt7XhOsOmTQqCpH7 pRcZ5juxZCOxXG2fTQTQo0gfF5+PQwQYUp0NdTbVox5PTx5RK3KfPqmAJsBKdwEaIkuY9FbM 9lGg8XBNzD2R/13cCd4hRrZDtyegrtocpBAruVqOZhsMb/h7Wd0TGoJ/zJr3w3WnDM08c+RA 5LHMbiA29MXq1KxlnsYDfWB8ts3HIJ3ROBvagA20mbOm26ddeFjLdGcBTrzbHbzCReEtN++s gZneKsYiueFDTxXjUOJgp8JDdVPM+++axSMo2js8TwVefTfCYt0oWMEqlQqSqgQwIuzpRO6I ik7HAFq8fssy2cY8Imofbj77uKz0BNZC/1nGG1OI9cU2jHrqsn1i95KaS6fPu4EN6XP/Gi/O 0DxND+HEyzVqhUJkvXUhTsOzgzWAvW9BlkKRiVizKM6PLsVm/XmeapGs4ir/U8OzKI+SM3R8 VMW8eovWgXNUQ9F2vS1dHO8eRn2UqDKBZSo+qCRWLRtsqNzmU4N0zuGqZSaDCvkMwF6kIRkD ZkDjjYQtoftPGchLBTUzeUa2gfOr1T4xSQUHhPL8zsFNBGZY+hkBEADb5quW4M0eaWPIjqY6 aC/vHCmpELmS/HMa5zlA0dWlxCPEjkchN8W4PB+NMOXFEJuKLLFs6+s5/KlNok/kGKg4fITf Vcd+BQd/YRks3qFifckU+kxoXpTc2bksTtLuiPkcyFmjBph/BGms35mvOA0OaEO6fQbauiHa QnYrgUQM+YD4uFoQOLnWTPmBjccoPuiJDafzLxwj4r+JH4fA/4zzDa5OFbfVq3ieYGqiBrtj tBFv5epVvGK1zoQ+Rc+h5+dCWPwC2i3cXTUVf0woepF8mUXFcNhY+Eh8vvh1lxfD35z2CJeY txMcA44Lp06kArpWDjGJddd+OTmUkFWeYtAdaCpj/GItuJcQZkaaTeiHqPPrbvXM361rtvaw XFUzUlvoW1Sb7/SeE/BtWoxkeZOgsqouXPTjlFLapvLu5g9MPNimjkYqukASq/+e8MMKP+EE v3BAFVFGvNE3UlNRh+ppBqBUZiqkzg4q2hfeTjnivgChzXlvfTx9M6BJmuDnYAho4BA6vRh4 Dr7LYTLIwGjguIuuQcP2ENN+l32nidy154zCEp5/Rv4K8SYdVegrQ7rWiULgDz9VQWo2zAjo TgFKg3AE3ujDy4V2VndtkMRYpwwuilCDQ+Bpb5ixfbFyZ4oVGs6F3jhtWN5Uu43FhHSCqUv8 FCzl44AyGulVYU7hTQARAQABwsF8BBgBCgAmFiEEAExkfXVyz31yvbT7aZ2FCp9Be9gFAmZY +hkCGwwFCQWjmoAACgkQaZ2FCp9Be9hN3g/8CdNqlOfBZGCFNZ8Kf4tpRpeN3TGmekGRpohU bBMvHYiWW8SvmCgEuBokS+Lx3pyPJQCYZDXLCq47gsLdnhVcQ2ZKNCrr9yhrj6kHxe1Sqv1S MhxD8dBqW6CFe/mbiK9wEMDIqys7L0Xy/lgCFxZswlBW3eU2Zacdo0fDzLiJm9I0C9iPZzkJ gITjoqsiIi/5c3eCY2s2OENL9VPXiH1GPQfHZ23ouiMf+ojVZ7kycLjz+nFr5A14w/B7uHjz uL6tnA+AtGCredDne66LSK3HD0vC7569sZ/j8kGKjlUtC+zm0j03iPI6gi8YeCn9b4F8sLpB lBdlqo9BB+uqoM6F8zMfIfDsqjB0r/q7WeJaI8NKfFwNOGPuo93N+WUyBi2yYCXMOgBUifm0 T6Hbf3SHQpbA56wcKPWJqAC2iFaxNDowcJij9LtEqOlToCMtDBekDwchRvqrWN1mDXLg+av8 qH4kDzsqKX8zzTzfAWFxrkXA/kFpR3JsMzNmvextkN2kOLCCHkym0zz5Y3vxaYtbXG2wTrqJ 8WpkWIE8STUhQa9AkezgucXN7r6uSrzW8IQXxBInZwFIyBgM0f/fzyNqzThFT15QMrYUqhhW ZffO4PeNJOUYfXdH13A6rbU0y6xE7Okuoa01EqNi9yqyLA8gPgg/DhOpGtK8KokCsdYsTbk= In-Reply-To: <20260820151029.802935-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8" X-ClientProxiedBy: FR2P281CA0112.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:9d::14) To AS4PR10MB6181.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:20b:588::19) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: AS4PR10MB6181:EE_|PAVPR10MB7403:EE_ X-MS-Office365-Filtering-Correlation-Id: 381b4f54-db68-4733-8c9e-08df033e1612 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|366016|376014|23010399003|1800799024|10067099003|56012099006|11063799006|6133799003|55112099003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: qmcCPWLBiZagKHZhc3G/2dLqSBBtdkPZA08X8LtkK5uaePs06My8z7hKPyAyYw1aay1RVzAYcq2wrwJLEgAumBylaXP/ueR/l2Dskgi+ib/kAh0tcxv2Q6DjPIsetO4scBbrG6W7xkri8Bu16afuJzZR7leXxlPCNTarcWz0uEMSipuonVwNhEfBav5rIAlop7xMmMzX5tJJkEFcwhP7TaS1jvHBs+hTAuu/q5yqlGsyyVbLBM+YIjz/j+vqc/y9YGLQ8o8l6ShKym90oMnoqOmak6m1kJ5QhQBrUGsk9YyAWJSub5+39sMTJimUTGZHuKhqhgGJhGdg+/t8SIY1BfwaIag6n5tWcnhublHBzrQtZVlSyLLKS15y+8D29jwggNdCGrKTpdf4E7ww1b4HCFRy5nE2M4rGMpZlFVE75B9uZXFP5oqcN+KiEBUyYWmtDWh8OpZNwUBAWyVp+zDrNuM6RpGVETC6fTo4afSmNTE6Gl2YmP8RtDidP7ZfyssoNWor9Lqy7H0fN7D1QwXlAPYWiJjX+/NUNJlfPbkan7qq/wy4FOf7hrRnidmiADFsM1abnUcWsuBS6IVbUJ9BnD8lE/1gYcDUEtUXP5e2rJ5iUIjb4xNRIA/8AqDnL0T368Nc60W3+PEIu7gOGye2sd/LoD+prcNsVGmYRlX2H+w= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:AS4PR10MB6181.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(366016)(376014)(23010399003)(1800799024)(10067099003)(56012099006)(11063799006)(6133799003)(55112099003)(18002099003)(22082099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?UjRsd0pWOXRobUdmNDFoSUFPRHVIZTlzeUs4MHBsZ1NRK1liZW1xakdLRk5W?= =?utf-8?B?N0w2bHhBUFBkWWUwZ2pFRmFOeDJORmgzUklmRmhidUxzZHlQNGhjOStsNzFr?= =?utf-8?B?T2Z2NXRnZHVTbUJuVXg1YzdPZHZZNHAwcTEraFBrc1RrZ3pBTnFsbXNWSnBJ?= =?utf-8?B?dmpJQWlkd2NxbjlNM0ZHQWZ3T2V4NnlpTUVHKzdpZkJadHIvaXY1b3VMWk8r?= =?utf-8?B?MDN3RC9CcGVpU09FaXlHTk1yRE1STzdIUm5sVHBjbWZ2Yk5wSDJrcEEzWTZY?= =?utf-8?B?ZG5ranVWSTFOY3h2SFp4MXlnME1LcWFxZjBVMG9TYkZKSHNnTW9memtPTGZH?= =?utf-8?B?SEhWM2lGTlhBdDBSRGNZa0FIaGQ2ellINmRVVEJCUEltM092NEtOWFEyc3g4?= =?utf-8?B?VStTbWRNbGY2eUQ2NHh4bjlhSWsyTVFSM3JxaUthZENRNDNtT0xja3V3L2Z4?= =?utf-8?B?ZmFxV3R1RDVvWjQ4dm5DenRQaWdGMS8wSWt6aWRGRmhhYTdHVklvYW1zZjFN?= =?utf-8?B?b0F5K200SXh6ak9QTElZK29wRWpGVVFTVFZzd2g4czUxakZmclFyYTVSdVNY?= =?utf-8?B?S0xFbUUrMGhhZk9aTG53RmQ4TStMMnRkRDZja21Qd2VzNWxLNmZZQktFSUl0?= =?utf-8?B?ajBRZTJydEhOM1lubzdzby9sQXMwUTRxR2VaQUR0OFcvcU5WZk1TQ1Rsd0Zl?= =?utf-8?B?WDBMa0puWGtEQUtNck92YkFPOG9HQmpmOGl1YjkwdzdyNnpicjBWaVdxZ0Yz?= =?utf-8?B?aHBLZ0grV0VvRDY0cC84dG0ycmRvOUJhZUJJa01XZlBjWmRCUy93WlArYWZw?= =?utf-8?B?ZmVDOGIvaFlmbEVya1VQM3h5ek5aNHYzRmltOHV2WmpVeGE1SjJKQmNTcDI4?= =?utf-8?B?SWphRlFpS0pyWU5idng3cjkvMWlYSi9TWHlKZmlMMUdSWTFldHpCZ0JZaEdW?= =?utf-8?B?VWxtNlBsaGpVbGpmSUdzd1lMRENsQWxrY3NDN3JFZFRCeFZIL2M4OU5haVls?= =?utf-8?B?S0N4Mm9pWEJkLytDNFU3RWtPbHBnWVp5VGlXRmZoc2I4cGxEbUhwNnU0djRq?= =?utf-8?B?cWcrZ0NCeTMyM01ubWNLQVFEcnY4dndMU1lHUzJLZzFza3ZKSmNOYW02dHU4?= =?utf-8?B?NnpWRVJ4Z0l1QXlESFd5R3djL1NoWXViancvdlBLSzh2eFdFRklXM2JpZURY?= =?utf-8?B?Slg2eFhEeCt2TEZZc2tCUktsZFN2TDhJU0hMVytxbGtsbkhnTVNRZzhGaWJ1?= =?utf-8?B?bDl2MVZTVkVMdGg2RXBBbXg3YXpBSUdwVll6d08yZmhNWGttTm9STHpQOWdE?= =?utf-8?B?TmNWVjFuQXViZkczQUN6TU16bVNqVHcyMEc0Y1dPR2dYWC85Y3pPV29pL2o4?= =?utf-8?B?Nkl4bTN0WDVOa0hWS2ExVmY1MjAwOWdvcmVyVzFOcFduRnBZdFMrOFlkdVJP?= =?utf-8?B?Q0NjVHZHdm95MnZCNDg4VU9MOXZmeG5JMStjQ3pvMCtnQ3V1ODRZSXJSaWVO?= =?utf-8?B?d21PK1p6cXhNK1FybGU2WWcxdW0yRzViWEZ5RHhTMGt0RUVWemVtZ3Zia3BW?= =?utf-8?B?QlBWSFpWR0NMcWV2R3RtY1FiMGREQ1N2Ykp3TGFPZVJhR3F4QUxoSkIyNkZE?= =?utf-8?B?Nm9rR2diVktTVS9XWE53Wm9zTDloNGd1TDRmZlNxVlVWdDVPeElLSXhPaTFS?= =?utf-8?B?Q2cyc1ZZR0xlY3JLWHNhZHdHcFZwR3c3a1NyUFNKS1Y3RUgvYm1NaDkvL3My?= =?utf-8?B?Y2h1T2JNYlAycFFERTJpVi80ME8vK09PYzhrVTdIUDVTZ01MWDlhaittS2V0?= =?utf-8?B?d0QrNEcxUnZUYmZDUlNqTCttaEFwYTdBaTZGclpOUWVaY2RoeEJmT3ExT3lJ?= =?utf-8?B?a093MUxZRUVjYzhmTEhMeTI0VmtYVGJEZXhwazQrNnVxdnV6ZVY4VkNIK0I0?= =?utf-8?B?eStGanhoc3JRN3UyRTZPS0YzcnZyM1MvYnRDN2lmMWEwenRKS2psOCtZZnZV?= =?utf-8?B?NlBhOWxBanlkMld1SG85R2UxckEzN1p6V055Q016MlpTYUNDSG45UFFWN1Rz?= =?utf-8?B?eVlxMWZDS0VxbmxpeVBYWXdkYnR2OS9QVWhSeUFENzJFUTF3MWtmUm82OUYy?= =?utf-8?B?bXMyL1RSY0pVcHF3NnFVaDVwVHNpT2Fveit5cTFTbk1jZHRYUklCa2ludkhz?= =?utf-8?B?a09sdXEvb1hNRmtTSEwzL0h5VjdJSTNKUG1ORUtxMWMyTUtLaTltQldyNVVT?= =?utf-8?B?K3U4QjlkQzhZSUkyd1pvRU5rWmhSZGN6dFBvZTBYc3dic2xkUC9yamM4QlJE?= =?utf-8?B?Tk5ydTNHU0RncnVpK0IzdllqUFZiRGtOOEZ4elhsR2ZNbDdHL3FSQT09?= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: 381b4f54-db68-4733-8c9e-08df033e1612 X-MS-Exchange-CrossTenant-AuthSource: AS4PR10MB6181.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Aug 2026 06:48:50.5384 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Nxh8h9JZhPxIl9wYRyJiCfno1KBn0tSxb6LKgAqOGodB6Iq3vRPLxXoiV9GBiLet7AcVSKJjgt256cXKPKcOEg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: PAVPR10MB7403 X-Original-Sender: jan.kiszka@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=ru2gkO98; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of jan.kiszka@siemens.com designates 2a01:111:f403:c201::3 as permitted sender) smtp.mailfrom=jan.kiszka@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Jan Kiszka Reply-To: Jan Kiszka Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2,RCVD_IN_RP_CERTIFIED, RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: Nu8BgHeM23CX On 20.08.26 17:10, Felix Moessbauer wrote: > The nobody/nogroup ids were mapped as part of the linear id range, > with an extra single-id mapping added only if the range was too small > to contain them. The extra mapping was guarded by "uid_cnt < nobody_id", > but the linear range ends at uid_cnt-2, so it covers nobody only for > uid_cnt >= 65536. For a count of 65534 or 65535 neither the linear range > nor the guard mapped nobody. > > Relying on the linear range to cover nobody is unsafe in general. If that > range covers the outer id that --map-root-user maps to, unshare punches a > hole out of the mapping, and per unshare(1) this "may result in the > highest user ID of the mapping not being mapped". That highest id is > exactly nobody. This happens whenever the subid range overlaps the id of > the calling user, e.g. with > > builder:0:65536 > > where the mapped block 1..65534 contains the builder's own uid. The > resulting namespace then silently lacks a nobody mapping, while a range > like 100000:65536 is unaffected and hides the problem. > > Map nobody/nogroup as a separate block at the top of the range and cap > the linear range at nobody_id-1. The separate block does not overlap > --map-root-user, so it survives, and a hole now at most costs id 65533. > > Fixes: 4fedb1ae ("add support for fully rootless builds") > Signed-off-by: Felix Moessbauer > --- > meta/classes-global/base.bbclass | 16 ++++++++++------ > 1 file changed, 10 insertions(+), 6 deletions(-) > > diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass > index f074eee6..c56b6b1a 100644 > --- a/meta/classes-global/base.bbclass > +++ b/meta/classes-global/base.bbclass > @@ -464,15 +464,19 @@ def run_privileged_cmd(d): > nobody_subid = uid_base + uid_cnt - 1 > gid_base, gid_cnt = get_subid_range('/etc/subgid', d) > nogroup_subid = gid_base + gid_cnt - 1 > + # nobody/nogroup need a dedicated block at the top of the range. As part > + # of the linear range they are lost whenever that range covers the outer > + # id of --map-root-user, because unshare then punches out a hole and > + # drops the highest id of the range. > + uid_linear_cnt = min(uid_cnt - 2, nobody_id - 1) > + gid_linear_cnt = min(gid_cnt - 2, nobody_id - 1) > cmd = 'unshare --mount --pid --uts --ipc --user' \ > ' --kill-child' \ > ' --setuid 0 --setgid 0 --fork' \ > - f' --map-users 1:{uid_base+1}:{uid_cnt-2}' \ > - f' --map-groups 1:{gid_base+1}:{gid_cnt-2}' > - if uid_cnt < nobody_id: > - cmd += f' --map-users {nobody_id}:{nobody_subid}:1' > - if gid_cnt < nobody_id: > - cmd += f' --map-groups {nobody_id}:{nogroup_subid}:1' > + f' --map-users 1:{uid_base+1}:{uid_linear_cnt}' \ > + f' --map-groups 1:{gid_base+1}:{gid_linear_cnt}' \ > + f' --map-users {nobody_id}:{nobody_subid}:1' \ > + f' --map-groups {nobody_id}:{nogroup_subid}:1' > cmd += " --map-root-user" > else: > cmd = 'sudo -E' What's the state of this? It blocks rootless CI in our gitlab. Jan -- Siemens AG, Foundational Technologies Linux Expert Center -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/1e9ed609-1d0d-4e58-a44e-4708577c130c%40siemens.com.