From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Mon, 31 Aug 2026 11:21:45 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-lj1-f183.google.com (mail-lj1-f183.google.com [209.85.208.183]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 67V9LiU9015779 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 31 Aug 2026 11:21:44 +0200 Received: by mail-lj1-f183.google.com with SMTP id 38308e7fff4ca-3a245f95649sf12357151fa.2 for ; Mon, 31 Aug 2026 02:21:44 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1788168099; cv=pass; d=google.com; s=arc-20260327; b=NB/FIlbOWYRKR/Gbv2JDuS5yUVMGlbW5RBHH36zfaEtEL/aTLRNzbPMMQeK8F0N6gS RsLNfM3cq3/rzIx1IjiRs9hr2pqDnXfOQ7Q/7Yc2c8xTN3ma47Qj+XoQUE/AmNkduqJ6 hC5XCDAg9jLfD4cs6stFfqowrrBJ6B3mpVs4qSLRW5R4HN7qR7UMQJ5Y6Aw5r/GF4awi 4Da4Ci1XSlyGvRPo/kCev8LW8cgHxQLFx77nDMAyg/PhkTGq6ds/KX23ucmjb9aKxcxY cdft1Ie+Y4OrR9AL0RRvDuwfhh4YaapAtcjFZKIV/AWsTR0RYsPAPYaLWdu3ayUaAv86 mXeQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:dkim-signature; bh=cfE5nu0fk91Mcf3Tp4Qdp6C1EmXnA85z+pJoY69X8+k=; fh=Ovp7Gd/prapthMSa/XQjOM88J7F5pJBH4+OFQcPsWjM=; b=CO03gB8EFo3dkv6LkxzOTANDxudtndQZgahyNb+ZA3FD12HSlPFrJVLGdyiM/FPM++ ATW1kR1/I6dtwKVGWEVF1HNjgO8VXq2Q8DRThRLwgEFajVwsjiDQkb/UJTEMctg7eXOt LmkN+cSWRqt+co+JzmSydGscZYvkWRkoY4sonZpKqMI2krDyrlmU0u0cI9F+9WQcoVss RUY7DQc1yxaVH4YkUjcXEB6rB8gpd5FErM6ePECLMXp0HRBhpMsYHrc5hBbrm8qXXAmh kvIvIn97/+pj5v86dHKKWowpNv5o6QICIEwDnY2JlbTSslGmref60sS2/VTCp8T0UrI+ dxag==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1788168099; x=1788772899; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-type:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:from:to:cc:subject:date:message-id:reply-to:content-type; bh=cfE5nu0fk91Mcf3Tp4Qdp6C1EmXnA85z+pJoY69X8+k=; b=IL9ztmRUuibofHL/1WPU0cXVX9Dq13anEHelxp9+dVtsheWaro5o6sopGgXwj3T5Ya N5Uen4m3JwLD9t745pyQvEOzwI5GbGly3hRRU43LSqKC49rtZhfDk7vxJ9zNEEvB9ljC sAlu8p+hQWZtaYziQt0SQsqBarnl8xFsirgLGO3LpGqBGbhGa0008rkFdDtI6Fg6+Oy4 2Q5aZn/ZTduC2d3hLnlWOIzU1h4vR3n3aV7k9Vtbbgdyz9YUZ1rZ4Ut12imP9G62hLNi v674db3zHeMEE48ELTbDs20g4wHfqLS1Dsci0KDsR1ojK7jQoeZpa8Tl0TOMHKYeKvfm GXiw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788168099; x=1788772899; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:content-type :in-reply-to:from:content-language:references:cc:to:subject :user-agent:mime-version:date:message-id:x-beenthere :x-gm-message-state:sender:from:to:cc:subject:date:message-id :reply-to:content-type; bh=cfE5nu0fk91Mcf3Tp4Qdp6C1EmXnA85z+pJoY69X8+k=; b=Aka0wzeVPyn1jEOenRl6uTNUnwYQkEHwQjupaHpjHSp+e5xQJJjrVHkaBgKSBdJPTA pqPAjuNvDXWchl7OhofafXkynVwGKHyhkqAqc1SNMaJMe4IkROAYKYvrhpjBX8bX3ddc SF3mZua/qYOFvRmtjxpBhW6fNzbBYm2Id5k0kkQVbJJKECXb22+xaTm6l9LAPjSsMtHk feGqsFBJmOCiE+6y71DA8dUSsoMtt6PrjR2+AOerwiWDEg7rMebDrRpqpw9jjSr4yf1C 2oR9lzaPtrko6DfTvjiSbdjS83vUrI/JACixDCahSkWxkgMgBw3XPCaSTJjx2GvchFEo 5sKg== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AKwUvBxzOFbwD+qDB2MBu9mOKQvPEhQn1VLfoFSay1TMVnv3PoxNHPHYp2VGeb0RFwCFHAWms18x@ilbers.de X-Gm-Message-State: AFuF++lhxze58Q3It6Ao6Hlhdk6UDjyuagqVEqT5aldG/OadscnOVAZO a+DS8oVE22+DgqSvUbzDqPGTG6wkT6ID+QOwIO3gcjgh7Bp/Bh/rUr9M X-Received: by 2002:a05:651c:2227:b0:3a3:2127:8ef3 with SMTP id 38308e7fff4ca-3a321279098mr27522291fa.10.1788168098831; Mon, 31 Aug 2026 02:21:38 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdf2spIj4BgPqgs4tYwas2tX87xuzis2jU0SgiKUNlXQ3g==" Received: by 2002:a2e:9d04:0:b0:3a1:2e7b:a1ad with SMTP id 38308e7fff4ca-3a23f586619ls7324131fa.0.-pod-prod-07-eu; Mon, 31 Aug 2026 02:21:35 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvByUHgBM1RLRl2c7DoWiObl1WIslQzL5OuJ+l6L55CU0boqirEF0w5SAsMGhU/ApxzmzFU5xt17mLKx0@googlegroups.com X-Received: by 2002:a05:651c:15c2:10b0:3a1:f8ff:da31 with SMTP id 38308e7fff4ca-3a301afbfc9mr36187391fa.7.1788168095333; Mon, 31 Aug 2026 02:21:35 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1788168095; cv=none; d=google.com; s=arc-20260327; b=EKCvv65t/XVoAI69qFp5DA3q4IntvuGshy/av98ecJ28IZI0vAXEtOqvpImq+JJRVe 5lCJ4AFXdRkTf1XTrNhh/h1cfI6pJXMpPfBzk6b22dRawhHP4pnyQGO+BEYZxZW8JRO6 GG1MQCvuuwTeyKmXtAPz28yaxshGsESiHZii+nrTiKcej0RC1Y9MZTNrRq1Hve5BimGo u2gOvh9I6JMJrfESjVwhlB/qq0Kb13Idmcr1V/JZBbDkhgcirq/x9psGixTYA81/xiww gFlaiuLnaszLfddNn7Vmj8Ox+gETIXXrmspEvF5IU/ewwSeq6KONFIipajZeHZSHo6V2 zs3w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id; bh=CD9CnJ4xk5HMwpiCscza+6TDg9HJbqQSoix0WQXEl6A=; fh=BUYIWGSWhRAjS1Abfnys+qgEo5bRA9dK5qbhQ4YgDh8=; b=fWgyx3mbhAvwew6grEyrHYxb6cfY1q7OYNjLURTJjPjbhEpKRbxScatklFOvorYxBG GGFAq1x23NJViPRnP2wwjgVdbZs3a+k0A130jGNN7Kvf3RXkSl8CMnhYVFKNdeHEyWDV SOOfcE9eoCAFssWaYivnZSIaHWunySMSnCcgVSUqiovpRhaOPYulvmpv/fuhdK4suDCY ttuvii8qPXC9+qzq/fSJaQ0vnUU9T96cjptuUl8V8WdrMghT76PdzJRQl1ew7G9FN1tw s3O2ogRq0W4LmgLtZZ3i7bvH3pz4j00AZ811+pvlUjUD9rbpksv9Otxc7qqwprBpE8tH 9+Pg==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id 38308e7fff4ca-3a3053b5853si1736501fa.2.2026.08.31.02.21.35 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 31 Aug 2026 02:21:35 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [172.20.10.6] ([47.64.49.69]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 67V9LWU7015772 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 31 Aug 2026 11:21:33 +0200 Message-ID: <7e233842-ec23-4a5e-bc2d-00e7b6de78bf@ilbers.de> Date: Mon, 31 Aug 2026 11:21:27 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/1] rootless: always map nobody/nogroup as dedicated block To: Jan Kiszka , Felix Moessbauer , isar-users@googlegroups.com Cc: michael.adler@siemens.com References: <20260820151029.802935-1-felix.moessbauer@siemens.com> <1e9ed609-1d0d-4e58-a44e-4708577c130c@siemens.com> Content-Language: en-US From: Zhihang Wei In-Reply-To: <1e9ed609-1d0d-4e58-a44e-4708577c130c@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H2, RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE,SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: agAaZRZGik5A On 8/26/26 08:48, Jan Kiszka wrote: > On 20.08.26 17:10, Felix Moessbauer wrote: >> The nobody/nogroup ids were mapped as part of the linear id range, >> with an extra single-id mapping added only if the range was too small >> to contain them. The extra mapping was guarded by "uid_cnt < nobody_id", >> but the linear range ends at uid_cnt-2, so it covers nobody only for >> uid_cnt >= 65536. For a count of 65534 or 65535 neither the linear range >> nor the guard mapped nobody. >> >> Relying on the linear range to cover nobody is unsafe in general. If that >> range covers the outer id that --map-root-user maps to, unshare punches a >> hole out of the mapping, and per unshare(1) this "may result in the >> highest user ID of the mapping not being mapped". That highest id is >> exactly nobody. This happens whenever the subid range overlaps the id of >> the calling user, e.g. with >> >> builder:0:65536 >> >> where the mapped block 1..65534 contains the builder's own uid. The >> resulting namespace then silently lacks a nobody mapping, while a range >> like 100000:65536 is unaffected and hides the problem. >> >> Map nobody/nogroup as a separate block at the top of the range and cap >> the linear range at nobody_id-1. The separate block does not overlap >> --map-root-user, so it survives, and a hole now at most costs id 65533. >> >> Fixes: 4fedb1ae ("add support for fully rootless builds") >> Signed-off-by: Felix Moessbauer >> --- >> meta/classes-global/base.bbclass | 16 ++++++++++------ >> 1 file changed, 10 insertions(+), 6 deletions(-) >> >> diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass >> index f074eee6..c56b6b1a 100644 >> --- a/meta/classes-global/base.bbclass >> +++ b/meta/classes-global/base.bbclass >> @@ -464,15 +464,19 @@ def run_privileged_cmd(d): >> nobody_subid = uid_base + uid_cnt - 1 >> gid_base, gid_cnt = get_subid_range('/etc/subgid', d) >> nogroup_subid = gid_base + gid_cnt - 1 >> + # nobody/nogroup need a dedicated block at the top of the range. As part >> + # of the linear range they are lost whenever that range covers the outer >> + # id of --map-root-user, because unshare then punches out a hole and >> + # drops the highest id of the range. >> + uid_linear_cnt = min(uid_cnt - 2, nobody_id - 1) >> + gid_linear_cnt = min(gid_cnt - 2, nobody_id - 1) >> cmd = 'unshare --mount --pid --uts --ipc --user' \ >> ' --kill-child' \ >> ' --setuid 0 --setgid 0 --fork' \ >> - f' --map-users 1:{uid_base+1}:{uid_cnt-2}' \ >> - f' --map-groups 1:{gid_base+1}:{gid_cnt-2}' >> - if uid_cnt < nobody_id: >> - cmd += f' --map-users {nobody_id}:{nobody_subid}:1' >> - if gid_cnt < nobody_id: >> - cmd += f' --map-groups {nobody_id}:{nogroup_subid}:1' >> + f' --map-users 1:{uid_base+1}:{uid_linear_cnt}' \ >> + f' --map-groups 1:{gid_base+1}:{gid_linear_cnt}' \ >> + f' --map-users {nobody_id}:{nobody_subid}:1' \ >> + f' --map-groups {nobody_id}:{nogroup_subid}:1' >> cmd += " --map-root-user" >> else: >> cmd = 'sudo -E' > What's the state of this? It blocks rootless CI in our gitlab. > > Jan > There were some problems with our rootless CI. Now we can merge it. Zhihang -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/7e233842-ec23-4a5e-bc2d-00e7b6de78bf%40ilbers.de.