----- Ursprüngliche Mail ----- > Von: "Alejandro Colomar" <alx@xxxxxxxxxx> > Can you please provide a small shell session where this is exemplified? Sure. I sent the following to the shadow maintainers privately on Friday, but since the issue is already known for years I don't hesitate to share. # On a Debian Bookworm # So far no entries are installed. $ cat /etc/subuid # useradd automatically does so. $ useradd -m rw $ cat /etc/subuid rw:100000:65536 # Let's create a folder where the group "nogames" has no permissions. $ mkdir /games $ echo win > /games/game.txt $ groupadd nogames $ chown -R root:nogames /games $ chmod 705 /games # User "rw" must not play games $ usermod -G nogames rw # Works as expected rw@localhost:~$ id uid=1000(rw) gid=1000(rw) groups=1000(rw),1001(nogames) rw@localhost:~$ cat /games/game.txt cat: /games/game.txt: Permission denied # By using unshare (which utilizes the newuidmap helper) we can get rid of the "nogames" group. rw@localhost:~$ unshare -S 0 -G 0 --map-users=100000,0,65536 --map-groups=100000,0,65536 id uid=0(root) gid=0(root) groups=0(root) rw@localhost:~$ unshare -S 0 -G 0 --map-users=100000,0,65536 --map-groups=100000,0,65536 cat /games/game.txt win Thanks, //richard
