Re: [PATCH 1/1] rootless: always map nobody/nogroup as dedicated block

[Zhihang Wei <wzh@ilbers.de>]

On 8/26/26 08:48, Jan Kiszka wrote:
> On 20.08.26 17:10, Felix Moessbauer wrote:
>> The nobody/nogroup ids were mapped as part of the linear id range,
>> with an extra single-id mapping added only if the range was too small
>> to contain them. The extra mapping was guarded by "uid_cnt < nobody_id",
>> but the linear range ends at uid_cnt-2, so it covers nobody only for
>> uid_cnt >= 65536. For a count of 65534 or 65535 neither the linear range
>> nor the guard mapped nobody.
>>
>> Relying on the linear range to cover nobody is unsafe in general. If that
>> range covers the outer id that --map-root-user maps to, unshare punches a
>> hole out of the mapping, and per unshare(1) this "may result in the
>> highest user ID of the mapping not being mapped". That highest id is
>> exactly nobody. This happens whenever the subid range overlaps the id of
>> the calling user, e.g. with
>>
>>    builder:0:65536
>>
>> where the mapped block 1..65534 contains the builder's own uid. The
>> resulting namespace then silently lacks a nobody mapping, while a range
>> like 100000:65536 is unaffected and hides the problem.
>>
>> Map nobody/nogroup as a separate block at the top of the range and cap
>> the linear range at nobody_id-1. The separate block does not overlap
>> --map-root-user, so it survives, and a hole now at most costs id 65533.
>>
>> Fixes: 4fedb1ae ("add support for fully rootless builds")
>> Signed-off-by: Felix Moessbauer <felix.moessbauer@siemens.com>
>> ---
>>   meta/classes-global/base.bbclass | 16 ++++++++++------
>>   1 file changed, 10 insertions(+), 6 deletions(-)
>>
>> diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass
>> index f074eee6..c56b6b1a 100644
>> --- a/meta/classes-global/base.bbclass
>> +++ b/meta/classes-global/base.bbclass
>> @@ -464,15 +464,19 @@ def run_privileged_cmd(d):
>>           nobody_subid = uid_base + uid_cnt - 1
>>           gid_base, gid_cnt = get_subid_range('/etc/subgid', d)
>>           nogroup_subid = gid_base + gid_cnt - 1
>> +        # nobody/nogroup need a dedicated block at the top of the range. As part
>> +        # of the linear range they are lost whenever that range covers the outer
>> +        # id of --map-root-user, because unshare then punches out a hole and
>> +        # drops the highest id of the range.
>> +        uid_linear_cnt = min(uid_cnt - 2, nobody_id - 1)
>> +        gid_linear_cnt = min(gid_cnt - 2, nobody_id - 1)
>>           cmd = 'unshare --mount --pid --uts --ipc --user' \
>>                 ' --kill-child' \
>>                 ' --setuid 0 --setgid 0 --fork' \
>> -              f' --map-users  1:{uid_base+1}:{uid_cnt-2}' \
>> -              f' --map-groups 1:{gid_base+1}:{gid_cnt-2}'
>> -        if uid_cnt < nobody_id:
>> -            cmd += f' --map-users  {nobody_id}:{nobody_subid}:1'
>> -        if gid_cnt < nobody_id:
>> -            cmd += f' --map-groups {nobody_id}:{nogroup_subid}:1'
>> +              f' --map-users  1:{uid_base+1}:{uid_linear_cnt}' \
>> +              f' --map-groups 1:{gid_base+1}:{gid_linear_cnt}' \
>> +              f' --map-users  {nobody_id}:{nobody_subid}:1' \
>> +              f' --map-groups {nobody_id}:{nogroup_subid}:1'
>>           cmd += " --map-root-user"
>>       else:
>>           cmd = 'sudo -E'
> What's the state of this? It blocks rootless CI in our gitlab.
>
> Jan
>

There were some problems with our rootless CI. Now we can merge it.

Zhihang

-- 
You received this message because you are subscribed to the Google Groups "isar-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/isar-users/7e233842-ec23-4a5e-bc2d-00e7b6de78bf%40ilbers.de.