From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Thu, 20 Aug 2026 17:10:52 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-pj1-f59.google.com (mail-pj1-f59.google.com [209.85.216.59]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 67KFAnJj015256 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Thu, 20 Aug 2026 17:10:49 +0200 Received: by mail-pj1-f59.google.com with SMTP id 98e67ed59e1d1-38e1118e4absf4245865a91.0 for ; Thu, 20 Aug 2026 08:10:49 -0700 (PDT) ARC-Seal: i=3; a=rsa-sha256; t=1787238643; cv=pass; d=google.com; s=arc-20260327; b=TQjd595CzMGcsgNPMD89n7Vpw9CZcFeR+Ot3n/eUe5pY2dWoXM6Oa2UwiN7+f9ggfH 54QVQKyP02xvFZY1C2QoAo4wla6NGk4v0GWGj6A8QzJH8cnOdVPOELcNjKOcY0Dn2Tr8 lKlvOQKus/2JaPTqftxY6fstwBIFvEfvDd4bPBEZa4icqG6XGd30MmLmPACuqC2Ck1hs lK3B79QQBlBGsCr1gt9oJGgOzbvLnOAoGogpq1KtnDIOWuXT+dPsZQ/LCjg5aKdoxtuc 2JN21l/YsBQHM61wNtArSGYBw+zQncaxacWcp8xeag06X+rz/90hRLSL7uLwSS6X/RAe Xxzw== ARC-Message-Signature: i=3; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to:mime-version:message-id :date:subject:cc:to:from:dkim-signature; bh=BJ9KK8Lzm7vvanjykNC/69lik3lbAg5ZDQYwotY2vVw=; fh=oGULQDIzH1drsTnEzzubSYRNmckNzBILEWaCmLMoTAs=; b=idlKgVL+qKhsR/XzdEK/fCFhQPtbAKvlcGIYiV3NyPrHEnAzGlBdasTzfKbZqgIhXD i+lfJLa0mYzFi/y7so7d5pRHBoHVEzCJjTnJzAkz/zLB54XsD5ApHXllhzxAXTPIH45V twnRpv4f4GKAF/9F2Bw2zIvWPaR83xv4gLDaJ9++3d9zbzxpQjOAubv85o9sSmERo8eb tpbB8lTLM8IuxGbnjhzky69kerUAKFJ/IF+ciPsl7ERwxubp2T2r3rtwmfFOyD0lHXOU lNpuAwHvS7f3RxY4l9V32V2kghbaXF3KG1sSVMrahqGX70k3NaFu9d0BDETld9b2hFZ9 EXNQ==; darn=ilbers.de ARC-Authentication-Results: i=3; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=bl3FhZJM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1787238643; x=1787843443; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:from:to:cc:subject :date:message-id:reply-to:content-type; bh=BJ9KK8Lzm7vvanjykNC/69lik3lbAg5ZDQYwotY2vVw=; b=JXfgYg6mCxlXSbXDwhteaR8thA78ZXqs5Q8I7u+KNI90PbnOlODyHCneV2g59sxiSx XjECl1pu9G/XTCcIqUihRy97Z3wk/OcA1mvrYKCvCqWLB2b4R2RIKiAr9VY0WQqAIizg /VuZ22TOrpzx9xHiLEMfWqCIy+4ol3TtDqLEvFGgte5FFGDND9ub7JkyWK3sw48n7R8p W8IXWtktP8kM3CHh0WWVwAQy2bVy+wL4JW+sBPMsUzj7wLzIEs9GtC583c+sf5exDjXH AjnWBwYV1+dkJbbPdM36/0C4LIlyEb4VCTQOF2yU2Zuuw0Xh4f2KTNJKvedVSClVbmrJ ugxg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787238643; x=1787843443; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence:reply-to :x-original-authentication-results:x-original-sender:mime-version :content-type:message-id:date:subject:cc:to:from:x-beenthere :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=BJ9KK8Lzm7vvanjykNC/69lik3lbAg5ZDQYwotY2vVw=; b=f9lsDMDqogXojw0xqU6dJj0ux1ENq2Zof1iDL4mHlbOKDb2SDcJtQou6Zc7gA4e8A4 DFWxxvLElrGiCC/X75nzYJeiNyESANYTbElEDMaONBQqnyRrVtvvK/n870gy+Id8XmYd g3ABVaod5cZLuYSleUcHsImfPbDV9HF+D9/GT4s+yXjzJLz2pjfKFzzjUeG2Pk92yEqr lQuFsXTmem1P8yu0NiPYEOwwZ0N8018TlUPGCBrzploL9fvLjMPBLJ6j2F8DogBx/l6x IkwDDqeG5uFfjtP1ErlifdxoBORoZOPrkI12K4rgNX0LW92YDR7KsWvc9J2T0Ne8/xNb sRXw== X-Forwarded-Encrypted: i=3; AHgh+Ro0+kd2xeJTt2iFrN8MmW6gIc9fJF7TifElWD7oxEM3KEyX6grX1hxLe4W/wh9+QCHSmxCa@ilbers.de X-Gm-Message-State: AFuF++l/1v2PCcOQJf66bISQgF6j5Zy4NOrN/TJm3qJdwJW1HLHTstuz a4sM3/t1NBzOUoexqubXFEYX1cUokAYHEKfOGIwNPYU7I87IBwcwyqMk X-Received: by 2002:a17:90b:510b:b0:38e:b400:a860 with SMTP id 98e67ed59e1d1-395810e84bamr25987633a91.13.1787238642977; Thu, 20 Aug 2026 08:10:42 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdet67LpzE35kquQJi+/OnhJ+7kxYWTB2o02S4EXQcl6Jg==" Received: by 2002:a17:90b:6cb:b0:37e:24af:2277 with SMTP id 98e67ed59e1d1-395a0860338ls1860819a91.1.-pod-prod-06-us; Thu, 20 Aug 2026 08:10:40 -0700 (PDT) X-Received: by 2002:a17:90b:1804:b0:38f:dec8:f7e9 with SMTP id 98e67ed59e1d1-395810b5a15mr23928582a91.12.1787238640632; Thu, 20 Aug 2026 08:10:40 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1787238640; cv=pass; d=google.com; s=arc-20260327; b=CNhl+CZybCID0moidrLpLg2U6JwOQi4Rv7GrTUPEDr8/3irQmegbs6Yygp6qUJdZ1y uQpOkeBM3JXEKHIgG7m58ZBHeMSr5R6icynAUm6ZNj+WcbmISM6IuwyC4BxFzt9+heD1 8avMeI8/clcvxWRWLs5SL1UKX7V89as6XZ07S3xgB0YRji+qW5CcW6u2C2pDpVQaTlVr 5jWWT2hqrvXXxafpVnYNCMDvfwKfQPgGYbQbTosaboQwoPjBnGVyDvvDP6VptM3iCsvb ABkRUr96C9/1/9y6Gpnf7fbHpyFIRO5VCG4/vE5EwYTxxYGPmeC4JSUhwiR7VIEYaCuq 7qMA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=mime-version:content-transfer-encoding:message-id:date:subject:cc :to:from:dkim-signature; bh=G6fFvGBPoX/r5HqcKEez633yvtA1llw0aSfnGC3ntvM=; fh=akEDxqCx8SXNfng4/80otlrEVebDroEzjSeLu6ZY87w=; b=mZOC1OzIwZiMIHKOFKa/E5NbqhpU7JjkN+/xQxBxPR932gx49yMdZ6znIbT86a2bGz +03XI0YK8FvRQbs7vjj4u8f85aXzsZfoi3vnsz+DtfY6I5QCEsLTGQ6RTD+ca6OvM4fA LydMhTkhn7Fdcnf/QMFsB/2qHGeVOQT6UqLO9wWoZHYMYWUMJa2WkcKlvyLYgaDgBNMs +3b9YnCxpnFEzM19BUC9aWMWlTTBSC7jJDnsmMy19HuFkfg+9yQBBz+iINApUzlEoUXZ 9opXjz/Jh4Qdla3Tsyz6mlCYE4K3l9jqvmi7x8bbHcjt/BJ2A5ToCIpy8+EHogaEflhw WQ8w==; dara=google.com ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=bl3FhZJM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com Received: from AM0PR02CU008.outbound.protection.outlook.com (mail-westeuropeazlp170130006.outbound.protection.outlook.com. [2a01:111:f403:c201::6]) by gmr-mx.google.com with ESMTPS id 98e67ed59e1d1-395a9c0e996si58424a91.0.2026.08.20.08.10.40 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 08:10:40 -0700 (PDT) Received-SPF: pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) client-ip=2a01:111:f403:c201::6; ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=pxf3YQlHCrmTI3x9MUZyjvM2S1CdADTlgP7I0rnnL6duEW3U4FHECI44dRuZMou4AInsYOv8iIVSCiOSpBwZJn3SarII5h+P+5tHJGI6af5Lzc/2yQXTO55wuCUUCbzhhzZePL/WvRhiUvX7ppGL6S4JasS9Z4pPv8nLdFagJNa/bxb+5IVlV7dVQgRkMgKY1zdS/GjQD/Vt0H8PoWD6fbFNEXrgT+eAbUSC7/2CWKyyxlRKVXDaMErdLrLTrkI1gXQeHO/KlyaeLYRMT2J2A+NXn6jTVTbTNZAQn9GpTmOBvE0NUaF/AFHVOFymC1WR/C6nm4YGQG5ww80TeGKz4Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=G6fFvGBPoX/r5HqcKEez633yvtA1llw0aSfnGC3ntvM=; b=EwhJVGJjjzHDbn6aeo6fH70UkwTk7lw7CbGP0McJEVqUtpzIQo4CWt9NVyKGoqxLTdkwlkAPtIWg3AecQOb089KwLdCIMzNm/FJRWivkwENqJdha6v0DwZwzzYa534aXqt8Q5By2shA271DubKL2rDHnT3RQqoeBCHW4CmuWfBvcxSiWe1SlVzhAfYU/pgrI+cZjF+uwTS91lW8qHvFee3oQiRZuuayma46jUdC8DxqX7uiyjWGc79SMXgYA+Y0FkjkP3MOGEHIweP0m+X0KhPK74fMN0LNwOTZshYg4Bh05M5auHuKviPHPn0gZ2txWbcrxBI98LkNGI8BlFDt8RQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=siemens.com; dmarc=pass action=none header.from=siemens.com; dkim=pass header.d=siemens.com; arc=none Received: from VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:800:14a::21) by PA1PR10MB8869.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:102:440::19) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.339.8; Thu, 20 Aug 2026 15:10:37 +0000 Received: from VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM ([fe80::4985:cc3c:fb41:6886]) by VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM ([fe80::4985:cc3c:fb41:6886%5]) with mapi id 15.21.0339.007; Thu, 20 Aug 2026 15:10:37 +0000 From: "'Felix Moessbauer' via isar-users" To: isar-users@googlegroups.com Cc: jan.kiszka@siemens.com, michael.adler@siemens.com, Felix Moessbauer Subject: [PATCH 1/1] rootless: always map nobody/nogroup as dedicated block Date: Thu, 20 Aug 2026 17:10:29 +0200 Message-ID: <20260820151029.802935-1-felix.moessbauer@siemens.com> X-Mailer: git-send-email 2.55.0 Content-Type: text/plain; charset="UTF-8" X-ClientProxiedBy: FR4P281CA0059.DEUP281.PROD.OUTLOOK.COM (2603:10a6:d10:cc::7) To VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM (2603:10a6:800:14a::21) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VE1PR10MB3967:EE_|PA1PR10MB8869:EE_ X-MS-Office365-Filtering-Correlation-Id: 5c2c7d60-a2c5-4381-9ad5-08defecd30b1 X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|1800799024|366016|23010399003|10070799003|376014|10067099003|56012099006|11063799006|55112099003|18002099003; X-Microsoft-Antispam-Message-Info: JIYAdGTk8mZG8zfKEZHav8JDVu3qf2ubFJR+b/wazssVGezmfxRb+YMTbspzHt7r7NHU3wZYRT4GXxnxtatQdnBLAM1mfl1FWSS76Z/GzHgXih8cXuJLB7THhgOiXedvFbK20CkgeLDEdkaa5+WWboFiiR/6o1rdV9g44UECYMnBEr0xNVoG4wnMZDMGBD3O3EVK/yPFZUAS9SbikeQtAtaAxcBz63K3s5qt1U+GTntXha4s7xFB/0ARSm9N+aa3l2OKH1tD9nV0M/Oh0cnLh4I0+KhFGe+nNbKqD2+2ooNeEpA5fj2uk2YA/L7S0pKpyF8Mx+GwnJhoGE7qctzWZY+4dMIdTLfDMlpK7RIMhvRkwGqxobY9q3mGDN0/rYq1grqHol55OLnHWbl0Kx4Hdkjc9RwI2ioJXTme981iwB1nb9id27pXn44ogEOmzOsk4XGDIejb8RhG5JNOoKdmKC20744DwJ+JZINmw4k8gw1p9Hnn/Y4AzIvFlGeg9gVzVs8dlZF/SLkIyj8uRFr8Qj89cr2QjGIwVmTYJauTEd3+vfxqt7sneC/nnw2PV+Oshyqy48nhIg5nuPjaHKoj1geRpdlDHGOjj80SZkSsS8YEICTwSWySGb2VwtZt1ixTtSiGXTf/5n39wbuv3qZnVeCCkws4eii3v9uorOrz1xA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(1800799024)(366016)(23010399003)(10070799003)(376014)(10067099003)(56012099006)(11063799006)(55112099003)(18002099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 2 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?0sCNHYR/Svtn/Mpk+US5yj4+akpK9EhxS/bFJkA7CM/MKDeElM0RqDsAMI2Q?= =?us-ascii?Q?9JrvdtzgYnSO4SMQjjZdRUzxWPgqy3sqigCxHzt+6HY5mDM2edSWMD9Ig3XL?= =?us-ascii?Q?fVXzBtgnBQcy0ZSeBFW42hne2kRX3aWleTjLCT1mHBg/E3uHjA6P8oi0kQlv?= =?us-ascii?Q?sJg1XqDRLv1tm9Oz+mMR4SEsD3JnwbLVdGQ5S2TIZyw3nvaaIcaO6k2zORnl?= =?us-ascii?Q?fyJRBfgtSJo5TqJWRsMKm9OUT3+2OvHdzGegvNEfsodgwxhJxSQhio2IP6tI?= =?us-ascii?Q?+PvXvGR0bpze86TTAm1R1067v1LL5c6KEkmjMbfDbjvIRtQtNXwWV0yadbMz?= =?us-ascii?Q?lChQM52ul8H0q/x06k4TyMsBB70hy1i+/vzE19t4ZOb/Q1IsFgmBFByt1AzK?= =?us-ascii?Q?6nw0Rt/JQ5brpRpJZ59+bMxgsZVoJHFT9DUiIK14u6vmpKZ0M0tg5sGKDU98?= =?us-ascii?Q?qnhf0BhqgpWy+wtw97NgsZlBAESJ8wXWI08MlkYBepcdtzkxVT/TEqL1A6zP?= =?us-ascii?Q?A0QBMiJG1f0wsfOpvv+4hPKHwgBVZMyob0K0Flr/+dU9OtIoL6IChw14isZx?= =?us-ascii?Q?Vx0DKP0vMniSGEK412urrzbUF72pV/jnJ/p9ESIExBKemzYHjDQkJ7t6cJlc?= =?us-ascii?Q?c/hq274Spu+TZglEWC04W9/m17XKOrPxfij2H6720F2fY3FH8/SobWDR472Q?= =?us-ascii?Q?vkx22ApjIAeqWifXP5OELUgDxYcSXrOmatmcwtbTp+5fMhYaEpBc+xQxDMLV?= =?us-ascii?Q?g0bU0fLStEwh3mMhRaRO0c8rqSi4CPl1PtXLL0VMmlDmYX+VFVjTowcU0lAm?= =?us-ascii?Q?mSGNQtPg3A6woNVda75QksoOMT8MIQBHhB4O70Htl3cgP0ejR+zjPTc12JyM?= =?us-ascii?Q?my2s54ssazCnqh95oGf+RsHRij/Aaaliw+SUydH/QfGZ4PjmJedC6FuKxtv9?= =?us-ascii?Q?2QtIEQbQLa9qPAYn+cRe5KsyzoM7st7ZI1gxYq8oCcVu5W1DzjU+wQqaNo6k?= =?us-ascii?Q?eDAKyGnQcOyIxCB020wuaUvnRyTcrC+YT4HXSye9J1IOFzlYAipczb2NFn+v?= =?us-ascii?Q?uCCxhoGgGiTT1e8TF/P/OSLoSujWpD4JdbBz/K1y+kWXYFV3pDjfY/Wp3ELZ?= =?us-ascii?Q?0bCa3CRLVrEmw4DcRNqSKSS1CvjFEu7W23pCVGDIqD2UYfk3QAQ7AsVJIb0Y?= =?us-ascii?Q?Fnyk0uyzFXjcufOnkTuDP6cbd4xSyuwIrfeKsipZPudfKQMt4RLCg+ePDHSi?= =?us-ascii?Q?Jl6z1KHNkipLtqWTIPfJsdBWKLtAlNbByo5ih1RoQwlq94DgkB6fvunMXhw1?= =?us-ascii?Q?O0tXJ0pmllG+rHtzsecREkEUQamaGENWTkySOW4j/KxDW/Nj98MPjIGiUvzc?= =?us-ascii?Q?kO+79bAtls6xNowP0dkvNaDq1g1H5CRP2YK714mZhsEZVELEtPGuua02oJXt?= =?us-ascii?Q?rsBn0diDILV4KxQkHjIRX8zvl/qpwq54ohbWONtxPRhRCsyY8EW0EXCk0drD?= =?us-ascii?Q?kEnauNfWaN7HcdSSsqbDm15OuLJLBcLtENExUWucJqH2vxc3Yv4gsZLMfs24?= =?us-ascii?Q?iORJ9PlF9KjnemPPXx8FEumbaCL3V/aEb3bkGbKnqUkGPQluzVFO5Rn7c8p1?= =?us-ascii?Q?FFhWj0yfhL/za0qDcUoeNH7A7vGuAv23CDxSzm+lRYjDZ0xNo6KZYwoq9/hv?= =?us-ascii?Q?IGuDw0WKZ6WeenqsP8JfxH8JIZsJ/+WQMvF2mfqbJmVtr7nkHeTyVRHwvomq?= =?us-ascii?Q?XCzJ0pFjR5mHvT+wRz4bFkxp8ckwl1Abe9ifIBhLmtKxCSksF4je7znPCHck?= X-MS-Exchange-AntiSpam-MessageData-1: Wx+eJvT2jTmi2UwanXCHZ3dzFp0hpbqMUBY= X-OriginatorOrg: siemens.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5c2c7d60-a2c5-4381-9ad5-08defecd30b1 X-MS-Exchange-CrossTenant-AuthSource: VE1PR10MB3967.EURPRD10.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 Aug 2026 15:10:37.3259 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 38ae3bcd-9579-4fd4-adda-b42e1495d55a X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Pg6ng5vb0T2g2STMnD7xXaXtEJNlW9FycdRIqD1ZaoM1X5guaDO7QfXQ+p3Mr5AkrssNopX1v5iIBhZ5HDPhnYCpJRR+OKgldMZRuqaTLR4= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PA1PR10MB8869 X-Original-Sender: felix.moessbauer@siemens.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@siemens.com header.s=selector2 header.b=bl3FhZJM; arc=pass (i=1 spf=pass spfdomain=siemens.com dkim=pass dkdomain=siemens.com dmarc=pass fromdomain=siemens.com); spf=pass (google.com: domain of felix.moessbauer@siemens.com designates 2a01:111:f403:c201::6 as permitted sender) smtp.mailfrom=felix.moessbauer@siemens.com; dmarc=pass (p=REJECT sp=REJECT dis=NONE) header.from=siemens.com X-Original-From: Felix Moessbauer Reply-To: Felix Moessbauer Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-Spam-Status: No, score=-4.9 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,MAILING_LIST_MULTI, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3,RCVD_IN_MSPIKE_WL, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-TUID: hZ8bGNsnucZI The nobody/nogroup ids were mapped as part of the linear id range, with an extra single-id mapping added only if the range was too small to contain them. The extra mapping was guarded by "uid_cnt < nobody_id", but the linear range ends at uid_cnt-2, so it covers nobody only for uid_cnt >= 65536. For a count of 65534 or 65535 neither the linear range nor the guard mapped nobody. Relying on the linear range to cover nobody is unsafe in general. If that range covers the outer id that --map-root-user maps to, unshare punches a hole out of the mapping, and per unshare(1) this "may result in the highest user ID of the mapping not being mapped". That highest id is exactly nobody. This happens whenever the subid range overlaps the id of the calling user, e.g. with builder:0:65536 where the mapped block 1..65534 contains the builder's own uid. The resulting namespace then silently lacks a nobody mapping, while a range like 100000:65536 is unaffected and hides the problem. Map nobody/nogroup as a separate block at the top of the range and cap the linear range at nobody_id-1. The separate block does not overlap --map-root-user, so it survives, and a hole now at most costs id 65533. Fixes: 4fedb1ae ("add support for fully rootless builds") Signed-off-by: Felix Moessbauer --- meta/classes-global/base.bbclass | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass index f074eee6..c56b6b1a 100644 --- a/meta/classes-global/base.bbclass +++ b/meta/classes-global/base.bbclass @@ -464,15 +464,19 @@ def run_privileged_cmd(d): nobody_subid = uid_base + uid_cnt - 1 gid_base, gid_cnt = get_subid_range('/etc/subgid', d) nogroup_subid = gid_base + gid_cnt - 1 + # nobody/nogroup need a dedicated block at the top of the range. As part + # of the linear range they are lost whenever that range covers the outer + # id of --map-root-user, because unshare then punches out a hole and + # drops the highest id of the range. + uid_linear_cnt = min(uid_cnt - 2, nobody_id - 1) + gid_linear_cnt = min(gid_cnt - 2, nobody_id - 1) cmd = 'unshare --mount --pid --uts --ipc --user' \ ' --kill-child' \ ' --setuid 0 --setgid 0 --fork' \ - f' --map-users 1:{uid_base+1}:{uid_cnt-2}' \ - f' --map-groups 1:{gid_base+1}:{gid_cnt-2}' - if uid_cnt < nobody_id: - cmd += f' --map-users {nobody_id}:{nobody_subid}:1' - if gid_cnt < nobody_id: - cmd += f' --map-groups {nobody_id}:{nogroup_subid}:1' + f' --map-users 1:{uid_base+1}:{uid_linear_cnt}' \ + f' --map-groups 1:{gid_base+1}:{gid_linear_cnt}' \ + f' --map-users {nobody_id}:{nobody_subid}:1' \ + f' --map-groups {nobody_id}:{nogroup_subid}:1' cmd += " --map-root-user" else: cmd = 'sudo -E' -- 2.55.0 -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/20260820151029.802935-1-felix.moessbauer%40siemens.com.