Lennart Poettering
2f89304490
This new option does three things for a host user specified via --bind-user=: 1. Bind mount the home directory from the host directory into /run/host/home/<username> 2. Install an additional user namepace UID/GID mapping mapping the host UID/GID of the host user to an unused one from the container in the range 60514…60577. 3. Synthesize a user/group record for the user/group under the same name as on the host, with minimized information, and the UID/GID set to the mapped UID/GID. This data is written to /run/host/userdb/ where nss-system will pick it up. This should make sharing users and home directories from host into the container pretty seamless, under some conditions: 1. User namespacing must be used. 2. The host UID/GID of the user/group cannot be in the range assigned to the container (kernel already refuses this, as this would mean two host UIDs/GIDs might end up being mapped to the same continer UID/GID. 3. There's a free UID/GID in the aforementioned range in the container, and the name of the user/group is not used in the container. 4. Container payload is new enough to include an nss-systemd version that picks up records from /run/host/userdb/
78 lines
1.8 KiB
Meson
78 lines
1.8 KiB
Meson
# SPDX-License-Identifier: LGPL-2.1-or-later
|
|
|
|
libnspawn_core_sources = files('''
|
|
nspawn-bind-user.c
|
|
nspawn-bind-user.h
|
|
nspawn-cgroup.c
|
|
nspawn-cgroup.h
|
|
nspawn-creds.c
|
|
nspawn-creds.h
|
|
nspawn-def.h
|
|
nspawn-expose-ports.c
|
|
nspawn-expose-ports.h
|
|
nspawn-mount.c
|
|
nspawn-mount.h
|
|
nspawn-network.c
|
|
nspawn-network.h
|
|
nspawn-oci.c
|
|
nspawn-oci.h
|
|
nspawn-patch-uid.c
|
|
nspawn-patch-uid.h
|
|
nspawn-register.c
|
|
nspawn-register.h
|
|
nspawn-seccomp.c
|
|
nspawn-seccomp.h
|
|
nspawn-settings.c
|
|
nspawn-settings.h
|
|
nspawn-setuid.c
|
|
nspawn-setuid.h
|
|
nspawn-stub-pid1.c
|
|
nspawn-stub-pid1.h
|
|
nspawn.h
|
|
'''.split())
|
|
|
|
nspawn_gperf_c = custom_target(
|
|
'nspawn-gperf.c',
|
|
input : 'nspawn-gperf.gperf',
|
|
output : 'nspawn-gperf.c',
|
|
command : [gperf, '@INPUT@', '--output-file', '@OUTPUT@'])
|
|
|
|
libnspawn_core_sources += [nspawn_gperf_c]
|
|
|
|
libnspawn_core = static_library(
|
|
'nspawn-core',
|
|
libnspawn_core_sources,
|
|
include_directories : includes,
|
|
dependencies : [libacl,
|
|
libseccomp,
|
|
libselinux])
|
|
|
|
systemd_nspawn_sources = files('nspawn.c')
|
|
|
|
############################################################
|
|
|
|
tests += [
|
|
[['src/nspawn/test-nspawn-tables.c'],
|
|
[libnspawn_core,
|
|
libshared],
|
|
[libseccomp]],
|
|
|
|
[['src/nspawn/test-patch-uid.c'],
|
|
[libnspawn_core,
|
|
libshared],
|
|
[libacl],
|
|
[], '', 'manual'],
|
|
]
|
|
|
|
fuzzers += [
|
|
[['src/nspawn/fuzz-nspawn-settings.c'],
|
|
[libshared,
|
|
libnspawn_core],
|
|
[libseccomp]],
|
|
|
|
[['src/nspawn/fuzz-nspawn-oci.c'],
|
|
[libshared,
|
|
libnspawn_core],
|
|
[libseccomp]],
|
|
]
|