6dfd290031
Recently, PrivateUsers=identity was added to support mapping the first 65536 UIDs/GIDs from parent to the child namespace and mapping the other UID/GIDs to the nobody user. However, there are use cases where users have UIDs/GIDs > 65536 and need to do a similar identity mapping. Moreover, in some of those cases, users want a full identity mapping from 0 -> UID_MAX. To support this, we add PrivateUsers=full that does identity mapping for all available UID/GIDs. Note to differentiate ourselves from the init user namespace, we need to set up the uid_map/gid_map like: ``` 0 0 1 1 1 UINT32_MAX - 1 ``` as the init user namedspace uses `0 0 UINT32_MAX` and some applications - like systemd itself - determine if its a non-init user namespace based on uid_map/gid_map files. Note systemd will remove this heuristic in running_in_userns() in version 258 (https://github.com/systemd/systemd/pull/35382) and uses namespace inode. But some users may be running a container image with older systemd < 258 so we keep this hack until version 259 for version N-1 compatibility. In addition to mapping the whole UID/GID space, we also set /proc/pid/setgroups to "allow". While we usually set "deny" to avoid security issues with dropping supplementary groups (https://lwn.net/Articles/626665/), this ends up breaking dbus-broker when running /sbin/init in full OS containers. Fixes: #35168 Fixes: #35425 |
||
|---|---|---|
| .clusterfuzzlite | ||
| .github | ||
| .semaphore | ||
| catalog | ||
| coccinelle | ||
| docs | ||
| factory | ||
| hwdb.d | ||
| LICENSES | ||
| man | ||
| mime | ||
| mkosi.conf.d | ||
| mkosi.coverage | ||
| mkosi.extra | ||
| mkosi.extra.common | ||
| mkosi.images | ||
| mkosi.repart | ||
| mkosi.sanitizers | ||
| mkosi.uki-profiles | ||
| modprobe.d | ||
| network | ||
| po | ||
| presets | ||
| profile.d | ||
| rules.d | ||
| shell-completion | ||
| src | ||
| sysctl.d | ||
| sysusers.d | ||
| test | ||
| tmpfiles.d | ||
| tools | ||
| units | ||
| xorg | ||
| .clang-format | ||
| .ctags | ||
| .dir-locals.el | ||
| .editorconfig | ||
| .gitattributes | ||
| .gitignore | ||
| .gitmodules | ||
| .mailmap | ||
| .packit.yml | ||
| .pylintrc | ||
| .vimrc | ||
| .ycm_extra_conf.py | ||
| LICENSE.GPL2 | ||
| LICENSE.LGPL2.1 | ||
| meson_options.txt | ||
| meson.build | ||
| meson.version | ||
| mkosi.clangd | ||
| mkosi.clean | ||
| mkosi.conf | ||
| mkosi.functions | ||
| mkosi.postinst.chroot | ||
| mypy.ini | ||
| NEWS | ||
| README | ||
| README.md | ||
| ruff.toml | ||
| TODO | ||
System and Service Manager
Details
Most documentation is available on systemd's web site.
Assorted, older, general information about systemd can be found in the systemd Wiki.
Information about build requirements is provided in the README file.
Consult our NEWS file for information about what's new in the most recent systemd versions.
Please see the Code Map for information about this repository's layout and content.
Please see the Hacking guide for information on how to hack on systemd and test your modifications.
Please see our Contribution Guidelines for more information about filing GitHub Issues and posting GitHub Pull Requests.
When preparing patches for systemd, please follow our Coding Style Guidelines.
If you are looking for support, please contact our mailing list, join our IRC channel #systemd on libera.chat or Matrix channel
Stable branches with backported patches are available in the stable repo.
We have a security bug bounty program sponsored by the Sovereign Tech Fund hosted on YesWeHack