Hi Richard, On 2023-08-29 23:32, Richard Weinberger wrote: > ----- Ursprüngliche Mail ----- >> Von: "Alejandro Colomar" <alx@xxxxxxxxxx> >> Can you please provide a small shell session where this is exemplified? > > Sure. I sent the following to the shadow maintainers privately on Friday, > but since the issue is already known for years I don't hesitate to share. > > # On a Debian Bookworm > # So far no entries are installed. > $ cat /etc/subuid > > # useradd automatically does so. > $ useradd -m rw > $ cat /etc/subuid > rw:100000:65536 > > # Let's create a folder where the group "nogames" has no permissions. > $ mkdir /games > $ echo win > /games/game.txt > $ groupadd nogames > $ chown -R root:nogames /games > $ chmod 705 /games > > # User "rw" must not play games > $ usermod -G nogames rw > > # Works as expected > rw@localhost:~$ id > uid=1000(rw) gid=1000(rw) groups=1000(rw),1001(nogames) > rw@localhost:~$ cat /games/game.txt > cat: /games/game.txt: Permission denied > > # By using unshare (which utilizes the newuidmap helper) we can get rid of the "nogames" group. > rw@localhost:~$ unshare -S 0 -G 0 --map-users=100000,0,65536 --map-groups=100000,0,65536 id > uid=0(root) gid=0(root) groups=0(root) > > rw@localhost:~$ unshare -S 0 -G 0 --map-users=100000,0,65536 --map-groups=100000,0,65536 cat /games/game.txt > win > > Thanks, > //richard Thanks! Please include this in the commit message (at least for the Linux man-pages one). Cheers, Alex -- <http://www.alejandro-colomar.es/> GPG key fingerprint: A9348594CE31283A826FBDD8D57633D441E25BB5
Attachment:
OpenPGP_signature.asc
Description: OpenPGP digital signature
