I am waaaay behind on email.
On 01/22/2013 03:11:19 AM, Eric W. Biederman wrote:
The kernel support for user namespaces allows ordinary users to use
multiple uids and gids if they can get a trusted program to tell the
kernel the set of subordinate uids and gids they are allowed to use.
Could you give an example of this? (If this takes off I'll probably
want to add support to toybox, but from the man pages I don't
understand what it's for.)
This is my work to make that trusted program.
Two new files are added /etc/subuid /etc/subgid that specify
ranges of uids and gids that users may uses.
They must use a contiguous range with count, not
"landley:4000-4999,6103,7002-7005"?
useradd, and newusers are modifed to add users to those files.
userdel is modeifed to remove users from those files.
usermod is modified to give manual control of what goes in those
files.
newuidmap and newgidmap read the new files and update
/proc/[pid]/uid_map and /proc/[pid]/gid_map respectively
as requested by their command line parameters and as allowed
by the /etc/subuid and /etc/subgid.
I'm not finding uid_map and gid_map in
Documentation/filesystems/proc.txt, is this a pending patch?
Rob
_______________________________________________
Containers mailing list
Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx
https://lists.linuxfoundation.org/mailman/listinfo/containers
