Daan De Meyer
95d05079bf
mkosi does all of its environment setup in an unprivileged user namespace with an identity mapping. When it invokes nspawn and nspawn tries to get a transient userns from nsresourced, this fails as no transient ranges are mapped into mkosi's unprivileged userns (as doing so would require privileges). To fix this problem, let's allow allocating unprivileged self user namespaces in nsresourced, similar to what the kernel allows, except that we also support delegations for these. This means that mkosi can get its unprivileged userns as before from nsresourced, but it can also request a delegated 64K range inside that userns as well, which nsresourced can then allocate to nspawn later when it asks for one. Similar to the kernel, we disallow setgroups for self mappings. However, instead of doing this via /proc/self/setgroups, which applies to the current user namespace and all its child user namespaces, we use the BPF LSM to deny setgroups instead, so that it can still be allowed for child user namespaces. We need this because as soon as a container launches in a child user namespace using one of the delegated mappings, it has to be able to do setgroups() to be able to function properly. To allow mapping the root user, we need to add the CAP_SETFCAP capability to nsresourced.
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack
Repositories with distribution packages built from git main are available on OBS, and also repositories with packages built from the latest stable release