From b917743d50bf503196b84148a6770db0094de4a5 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 27 Jun 2022 10:29:13 +0900 Subject: [PATCH 1/2] nspawn: update help message for user namespacing Follow-up for 33eac552ab22af58b303342b1fa912900fa42820. --- src/nspawn/nspawn.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index ded6c44778..f90207c508 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -359,12 +359,16 @@ static int help(void) { " --keep-unit Do not register a scope for the machine, reuse\n" " the service unit nspawn is running in\n\n" "%3$sUser Namespacing:%4$s\n" - " -U --private-users=pick Run within user namespace, autoselect UID/GID range\n" - " --private-users[=UIDBASE[:NUIDS]]\n" + " --private-users=no Run without user namespacing\n" + " --private-users=yes|pick|identity\n" + " Run within user namespace, autoselect UID/GID range\n" + " --private-users=UIDBASE[:NUIDS]\n" " Similar, but with user configured UID/GID range\n" " --private-users-ownership=MODE\n" " Adjust ('chown') or map ('map') OS tree ownership\n" - " to private UID/GID range\n\n" + " to private UID/GID range\n" + " -U Equivalent to --private-users=pick and\n" + " --private-users-ownership=auto\n\n" "%3$sNetworking:%4$s\n" " --private-network Disable network in container\n" " --network-interface=INTERFACE\n" From 5ad08191d85d6dd058b9d07ccf37ae4b709564e5 Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Mon, 27 Jun 2022 10:31:53 +0900 Subject: [PATCH 2/2] nspawn: support PrivateUsers=identity Follow-up for 33eac552ab22af58b303342b1fa912900fa42820. Fixes #23825. --- src/nspawn/nspawn-settings.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/nspawn/nspawn-settings.c b/src/nspawn/nspawn-settings.c index 3a5d72549a..48daaa83e1 100644 --- a/src/nspawn/nspawn-settings.c +++ b/src/nspawn/nspawn-settings.c @@ -623,6 +623,11 @@ int config_parse_private_users( settings->userns_mode = USER_NAMESPACE_PICK; settings->uid_shift = UID_INVALID; settings->uid_range = UINT32_C(0x10000); + } else if (streq(rvalue, "identity")) { + /* identity: User namespacing on, UID range is 0:65536 */ + settings->userns_mode = USER_NAMESPACE_FIXED; + settings->uid_shift = 0; + settings->uid_range = UINT32_C(0x10000); } else { const char *range, *shift; uid_t sh, rn;