From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from shymkent.ilbers.de ([unix socket]) by shymkent (Cyrus 2.5.10-Debian-2.5.10-3+deb9u2) with LMTPA; Mon, 31 Aug 2026 11:26:05 +0200 X-Sieve: CMU Sieve 2.4 Received: from mail-ej1-f61.google.com (mail-ej1-f61.google.com [209.85.218.61]) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPS id 67V9Q42a015887 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT) for ; Mon, 31 Aug 2026 11:26:05 +0200 Received: by mail-ej1-f61.google.com with SMTP id a640c23a62f3a-c16711b9473sf259264266b.2 for ; Mon, 31 Aug 2026 02:26:05 -0700 (PDT) ARC-Seal: i=2; a=rsa-sha256; t=1788168359; cv=pass; d=google.com; s=arc-20260327; b=aeQtS9+SZO/0I8CnRFrlvzUQ5LYrNVph3SaqpMtepYKzDS7v0k8ybsi+EzYW7LRzN/ wixu6FqHZ3mDO+f9LB7XiMhDigFCbrBK/GhaT+JXERz6Xjdl0TppP85oegSkHeFWZOYB +DkuqAMepcLbVn8KST2hEvzwgdFNSha5toPA/tVTRAC7aTMYE+TSoaOFjeDM5vxAS3ya F+v5VUgBcEnPYqDvJEyZbSE7FVRBl9PjbVHgdKh52Xr6SRdJPsFX+7dld35uwVGmmVry Bj2mDh1dCD96w43WmPNu3sqcywbLymGMjV7AtJNNqgnnGglvvKjIZY+sxNsD4mtYu0K3 +rtA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:dkim-signature; bh=aLjVQpezFuI2gxo6u/S63DrhEwEZ6jejwE7PGIrFzq8=; fh=0DsUMDD1pAHVB9IRleguu8U75Y1E84jWOcppQ2fNq1k=; b=GbT+eu65xkJs/Zavr78jSlbUkokiJixWxPzEOo0tgKKQczMNF47AQez8XAzqjyZEOg t2219rOJ77ksFmaARK/sIe5Li2thi4lnrrDSgTPuhGxBBnYvfft2BLKNmZruvPXxVG6K I594vjiF53RP4UiSgDCHXS+aG9y1aGLNDEJAOVub1cj8sxnjj5Fr14HUrC4ddiBVoFRN x7iXlF5H9f7Ixu1/ojgglo1A0eevN08mitGb12WD4M+0Of3ovBaEeJhyeD8GPepZqSby pd53JOH6CF/goPEAsscBoAv6fdi+3pabIH6q3Vrftql7Ke+BUzYwdbowUYkUYMs/Zz6A HwyQ==; darn=ilbers.de ARC-Authentication-Results: i=2; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20251104; t=1788168359; x=1788773159; darn=ilbers.de; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:content-type:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :sender:from:to:cc:subject:date:message-id:reply-to:content-type; bh=aLjVQpezFuI2gxo6u/S63DrhEwEZ6jejwE7PGIrFzq8=; b=RdXEVUZ5dBp0/Aekuz3RQimM9XfbNbe0KviqtkfhAVEoFlIHyTwdge+nKPdBoWNzg0 WJy2HfwvVT5+byh0WUQxGb1TAOPphenWIpXSkzfSEkJvZIgdiw3vZm2Cfe6cr7ZJ276B L/pSP9ea9W+KjK5hYG/MAQ3+O+YAkO5AomuQG5g6h9N0Yt1xmoammq9f9r7xi2tPI1qn zwiclTxYJKtWyOr/66I59sgd4FOxlcXytSeP3/1dCscevP0zO/+Q7WXbIc5LTOLubB92 SP8cG68wWsRFQ+VMVWIWvI0pQfD8h1SBpA1/gaAAiKJD8iTFvz/3UG31h+p2HGGL81s1 HJgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788168359; x=1788773159; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:content-type :in-reply-to:from:content-language:references:cc:to:subject :user-agent:mime-version:date:message-id:x-beenthere :x-gm-message-state:sender:from:to:cc:subject:date:message-id :reply-to:content-type; bh=aLjVQpezFuI2gxo6u/S63DrhEwEZ6jejwE7PGIrFzq8=; b=Q3VHthPp89dlRm/DE6TJeha2oSbnf8hhasrQd4N5EL7k+p74KgGR4L9QJcAl7UvLTu v8nH38Jra9CF2sLMpOMxb2OMrjt6QGINCFUDKxQmaRXaYwEC35/nl+VZH/VRVpXejXKN P263jU3J+v840BV38mj289b4t6iDYyExihTm79td5cir08jsGdjuL5mLvkQGHGzeQLiu B9JjtXbewJRxaMRJ7vYcIjzoKqnbg4OalWvwdMmQlZKejhBncR+IXgOu5EUIyK5SjoCc JqL+3rK23BJksxzxGIk8lcUmQRsPsxmLPoCyseYlKU/lqa9OoPoARcYjE/dDH/QrYJRX iFlg== Sender: isar-users@googlegroups.com X-Forwarded-Encrypted: i=2; AKwUvBzcH73xTQcbMD3hOLX/5FgJZkY43pFbSy+snU0H/hd625gpWiIShzuq6kIPLVaIBT4guVwb@ilbers.de X-Gm-Message-State: AFuF++lSMGEZZhqhbFoMhj7xa816fZB+7lMO9VOPThFrMllKInM0rseL I1mAdSD5OCRL/NIn4i7boTCzWYcM5xlF6Yx9AVZtsiCYWeh/R87ZtwcN X-Received: by 2002:a05:6402:4145:b0:6a0:eb:ae41 with SMTP id 4fb4d7f45d1cf-6a60d383999mr16140049a12.10.1788168359246; Mon, 31 Aug 2026 02:25:59 -0700 (PDT) X-BeenThere: isar-users@googlegroups.com; h="ATskLdcVJE1d4AJNphEuHfow7c/IonItvWfP1FIMclLYn0g5Xw==" Received: by 2002:a05:6402:214d:b0:69e:1229:70b2 with SMTP id 4fb4d7f45d1cf-6a5f7d76ffels4328623a12.2.-pod-prod-08-eu; Mon, 31 Aug 2026 02:25:57 -0700 (PDT) X-Forwarded-Encrypted: i=2; AHgh+Ro9M38uPHqZ87INvF2C8oj9DBzM9HIvQ69wDAAw2qIabEMQyfdUnfVqktA1CW38BJW+4XfBkvlItMKX@googlegroups.com X-Received: by 2002:a17:906:9f90:b0:c25:3d01:fb16 with SMTP id a640c23a62f3a-c2556fe57a4mr1528321766b.4.1788168357135; Mon, 31 Aug 2026 02:25:57 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1788168357; cv=none; d=google.com; s=arc-20260327; b=eNE1S24DhPat2U2RhIlP0UH7UqMnkVC7omGfCH4uWMzepm6hSODiVi/fgBPbRbibi1 cFBQA8V69ApgTW3yOAwV1YOmhFI1NF1KLwG5bPLBf+zDFHXc/njIYI4uxUILAtHcJUE2 LeI1o8GFP0k7hzOpdMyvwlWqxkirX+d1t/z8QnfcfiegcutHfDO7M/AHBUKJb3n4TJqI fd3SPmAreyGZcEc5BHE+O7NsHrG2i1Rie6c2Dds5DTxTwZeQfc4wNs/fpXUbnK2ei0Wu SQCNsPM6dOg4KBZqgJVDvEytuW3rz7q2niJoZ9PqnB5Pw9+WOUkwoVZwKrAsWLiZEeQh QFxw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id; bh=YBygyaEEqhWVFWzaw3ATQ0Zwk3egD6wVoR5fkUZpCME=; fh=twdt7iNwKHA0z8UGpC9Czl1othSv8SnrMv1shTGXQfE=; b=LG1+9m7qywMILKEXg/0pV3i5CQ5IiEs8ZihPaOlTC+TmkkFXFZYAIbQdnQYHrnQGdZ d0LUb5rWhWxr5oImvZoUaLODoQ3EOeOAs7P6c2i3Sk0te6f2yttakVbbsNVjMw3kXBgi it63KTcuwgGdpXe/5cZj8gxXd6xEDdUjaSSDZxzxL77M8zyMyj5/9NHvpWL2SrUrvruv iyQoxOpUifJ8qtsMxU/XanaAmlYmeZw2GM1i1gyTIg1zOLo12Z2tn19z7nkA0RECf/wa CCd0osx/I267WNoaMrpO5hZxXEIhGEhnQf/8h9vQJOI3xdjEwQGJzcE0RfBKZ6BV3mp9 /YBw==; dara=google.com ARC-Authentication-Results: i=1; gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Received: from shymkent.ilbers.de (shymkent.ilbers.de. [85.214.156.166]) by gmr-mx.google.com with ESMTPS id a640c23a62f3a-c255f05e052si16652566b.2.2026.08.31.02.25.56 for (version=TLS1_2 cipher=ECDHE-ECDSA-CHACHA20-POLY1305 bits=256/256); Mon, 31 Aug 2026 02:25:57 -0700 (PDT) Received-SPF: pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) client-ip=85.214.156.166; Received: from [192.168.178.139] ([88.130.203.42]) (authenticated bits=0) by shymkent.ilbers.de (8.15.2/8.15.2/Debian-8+deb9u1) with ESMTPSA id 67V9Pu9R015874 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Mon, 31 Aug 2026 11:25:56 +0200 Message-ID: <9eca394a-6b1a-4e46-acb8-a8acafe8647f@ilbers.de> Date: Mon, 31 Aug 2026 11:25:56 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/1] rootless: always map nobody/nogroup as dedicated block To: Felix Moessbauer , isar-users@googlegroups.com Cc: jan.kiszka@siemens.com, michael.adler@siemens.com References: <20260820151029.802935-1-felix.moessbauer@siemens.com> Content-Language: en-US From: Zhihang Wei In-Reply-To: <20260820151029.802935-1-felix.moessbauer@siemens.com> Content-Type: text/plain; charset="UTF-8"; format=flowed X-Spam-Status: No, score=-4.6 required=5.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_EF,HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL,RCVD_IN_RP_CERTIFIED,RCVD_IN_RP_RNBL,RCVD_IN_RP_SAFE, SPF_PASS autolearn=unavailable autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on shymkent.ilbers.de X-Original-Sender: wzh@ilbers.de X-Original-Authentication-Results: gmr-mx.google.com; spf=pass (google.com: domain of wzh@ilbers.de designates 85.214.156.166 as permitted sender) smtp.mailfrom=wzh@ilbers.de Precedence: list Mailing-list: list isar-users@googlegroups.com; contact isar-users+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: isar-users@googlegroups.com X-Google-Group-Id: 914930254986 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , X-TUID: PiXQDEaTn5yy Applied to next, thanks. Zhihang On 8/20/26 17:10, 'Felix Moessbauer' via isar-users wrote: > The nobody/nogroup ids were mapped as part of the linear id range, > with an extra single-id mapping added only if the range was too small > to contain them. The extra mapping was guarded by "uid_cnt < nobody_id", > but the linear range ends at uid_cnt-2, so it covers nobody only for > uid_cnt >= 65536. For a count of 65534 or 65535 neither the linear range > nor the guard mapped nobody. > > Relying on the linear range to cover nobody is unsafe in general. If that > range covers the outer id that --map-root-user maps to, unshare punches a > hole out of the mapping, and per unshare(1) this "may result in the > highest user ID of the mapping not being mapped". That highest id is > exactly nobody. This happens whenever the subid range overlaps the id of > the calling user, e.g. with > > builder:0:65536 > > where the mapped block 1..65534 contains the builder's own uid. The > resulting namespace then silently lacks a nobody mapping, while a range > like 100000:65536 is unaffected and hides the problem. > > Map nobody/nogroup as a separate block at the top of the range and cap > the linear range at nobody_id-1. The separate block does not overlap > --map-root-user, so it survives, and a hole now at most costs id 65533. > > Fixes: 4fedb1ae ("add support for fully rootless builds") > Signed-off-by: Felix Moessbauer > --- > meta/classes-global/base.bbclass | 16 ++++++++++------ > 1 file changed, 10 insertions(+), 6 deletions(-) > > diff --git a/meta/classes-global/base.bbclass b/meta/classes-global/base.bbclass > index f074eee6..c56b6b1a 100644 > --- a/meta/classes-global/base.bbclass > +++ b/meta/classes-global/base.bbclass > @@ -464,15 +464,19 @@ def run_privileged_cmd(d): > nobody_subid = uid_base + uid_cnt - 1 > gid_base, gid_cnt = get_subid_range('/etc/subgid', d) > nogroup_subid = gid_base + gid_cnt - 1 > + # nobody/nogroup need a dedicated block at the top of the range. As part > + # of the linear range they are lost whenever that range covers the outer > + # id of --map-root-user, because unshare then punches out a hole and > + # drops the highest id of the range. > + uid_linear_cnt = min(uid_cnt - 2, nobody_id - 1) > + gid_linear_cnt = min(gid_cnt - 2, nobody_id - 1) > cmd = 'unshare --mount --pid --uts --ipc --user' \ > ' --kill-child' \ > ' --setuid 0 --setgid 0 --fork' \ > - f' --map-users 1:{uid_base+1}:{uid_cnt-2}' \ > - f' --map-groups 1:{gid_base+1}:{gid_cnt-2}' > - if uid_cnt < nobody_id: > - cmd += f' --map-users {nobody_id}:{nobody_subid}:1' > - if gid_cnt < nobody_id: > - cmd += f' --map-groups {nobody_id}:{nogroup_subid}:1' > + f' --map-users 1:{uid_base+1}:{uid_linear_cnt}' \ > + f' --map-groups 1:{gid_base+1}:{gid_linear_cnt}' \ > + f' --map-users {nobody_id}:{nobody_subid}:1' \ > + f' --map-groups {nobody_id}:{nogroup_subid}:1' > cmd += " --map-root-user" > else: > cmd = 'sudo -E' -- You received this message because you are subscribed to the Google Groups "isar-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to isar-users+unsubscribe@googlegroups.com. To view this discussion visit https://groups.google.com/d/msgid/isar-users/9eca394a-6b1a-4e46-acb8-a8acafe8647f%40ilbers.de.