Hi Eric, On Tue, Jan 22, 2013 at 01:11 -0800, Eric W. Biederman wrote: > The kernel support for user namespaces allows ordinary users to use > multiple uids and gids if they can get a trusted program to tell the > kernel the set of subordinate uids and gids they are allowed to use. > > This is my work to make that trusted program. > Two new files are added /etc/subuid /etc/subgid that specify > ranges of uids and gids that users may uses. > > useradd, and newusers are modifed to add users to those files. > > userdel is modeifed to remove users from those files. > > usermod is modified to give manual control of what goes in those files. > > newuidmap and newgidmap read the new files and update > /proc/[pid]/uid_map and /proc/[pid]/gid_map respectively > as requested by their command line parameters and as allowed > by the /etc/subuid and /etc/subgid. > > The following patches are against the current developent trunk > of pkg-shadow svn rev 3745. With minor tweaking of man/Makefile.am > these patches also apply to shadow 4.1.5. Why patch shadow tools? Why not implement the feature as a PAM module? All other capabilities granting things are implemented as PAM modules: pam_group, pam_namespace, pam_cap. I don't see why it cannot be fully modularized, a common admin doesn't need multiple uid/gid user_ns for non-root users at all, why patch basic tools? Thanks, -- Vasily Kulikov http://www.openwall.com - bringing security into open computing environments _______________________________________________ Containers mailing list Containers@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linuxfoundation.org/mailman/listinfo/containers
