2 Commits

Author	SHA1	Message	Date
Yu Watanabe	84d5d3af9d	man: fix typo ... Follow-up for 8aee931e7ae1adb01eeac0e1e4c0aef6ed3969ec. (cherry picked from commit 07e6a111c0c64b68147d940fabe4d3c4e63e1172)	2024-10-08 16:39:12 +01:00
Lennart Poettering	8aee931e7a	nsresourced: add new daemon for granting clients user namespaces and assigning resources to them ... This adds a small, socket-activated Varlink daemon that can delegate UID ranges for user namespaces to clients asking for it. The primary call is AllocateUserRange() where the user passes in an uninitialized userns fd, which is then set up. There are other calls that allow assigning a mount fd to a userns allocated that way, to set up permissions for a cgroup subtree, and to allocate a veth for such a user namespace. Since the UID assignments are supposed to be transitive, i.e. not permanent, care is taken to ensure that users cannot create inodes owned by these UIDs, so that persistancy cannot be acquired. This is implemented via a BPF-LSM module that ensures that any member of a userns allocated that way cannot create files unless the mount it operates on is owned by the userns itself, or is explicitly allowelisted. BPF LSM program with contributions from Alexei Starovoitov.	2024-04-06 16:08:24 +02:00