From 68ebbf936038e4e4c8b5105bd3246ef9709b6354 Mon Sep 17 00:00:00 2001 From: Iker Pedrosa Date: Mon, 7 Jun 2021 11:50:56 +0200 Subject: [PATCH 1/2] man: clarify subid delegation behaviour Following the discussion https://github.com/shadow-maint/shadow/pull/345 I have changed the documentation to clarify the behaviour of subid delegation when any subid source except files is configured. --- man/newgidmap.1.xml | 11 +++++------ man/newuidmap.1.xml | 11 +++++------ 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/man/newgidmap.1.xml b/man/newgidmap.1.xml index 7aaf34bf..681aefcb 100644 --- a/man/newgidmap.1.xml +++ b/man/newgidmap.1.xml @@ -87,12 +87,11 @@ DESCRIPTION - The newgidmap sets /proc/[pid]/gid_map based on its - command line arguments and the gids allowed. The subid delegation can come either from files - (/etc/subgid) or from the configured NSS subid module. Only one of them - can be chosen at a time. So, for example, if the subid source is configured as NSS and - groupadd is executed, then the command will fail and the entry will not be - created in /etc/subgid. + The newgidmap sets /proc/[pid]/gid_map + based on its command line arguments and the gids allowed. Subgid + delegation can either be managed via /etc/subgid + or through the configured NSS subid module. These options are mutually + exclusive. diff --git a/man/newuidmap.1.xml b/man/newuidmap.1.xml index 4bc1ef7a..09e65d80 100644 --- a/man/newuidmap.1.xml +++ b/man/newuidmap.1.xml @@ -87,12 +87,11 @@ DESCRIPTION - The newuidmap sets /proc/[pid]/uid_map based on its - command line arguments and the uids allowed. The subid delegation can come either from files - (/etc/subuid) or from the configured NSS subid module. Only one of them - can be chosen at a time. So, for example, if the subid source is configured as NSS and - useradd is executed, then the command will fail and the entry will not be - created in /etc/subuid. + The newuidmap sets /proc/[pid]/uid_map + based on its command line arguments and the uids allowed. Subuid + delegation can either be managed via /etc/subuid or + through the configured NSS subid module. These options are mutually + exclusive. From 0faec51bf0ec24e6e3d098cc55ed42584dd24efe Mon Sep 17 00:00:00 2001 From: Iker Pedrosa Date: Fri, 11 Jun 2021 15:25:42 +0200 Subject: [PATCH 2/2] man: definition and configuration of subid Define the subid functionality and explain the way to configure its delegation. --- man/subgid.5.xml | 32 +++++++++++++++++++++++++++++++- man/subuid.5.xml | 32 +++++++++++++++++++++++++++++++- 2 files changed, 62 insertions(+), 2 deletions(-) diff --git a/man/subgid.5.xml b/man/subgid.5.xml index 70c561c4..02f421ab 100644 --- a/man/subgid.5.xml +++ b/man/subgid.5.xml @@ -38,6 +38,11 @@ Biederman Creation, 2013 + + Iker + Pedrosa + Developer, 2021 + subgid @@ -48,11 +53,36 @@ subgid - the subordinate gid file + the configuration for subordinate group ids DESCRIPTION + + Subgid authorizes a group id to map ranges of group ids from its namespace + into child namespaces. + + + The delegation of the subordinate gids can be configured via the + subid field in + /etc/nsswitch.conf file. Only one value can be set + as the delegation source. Setting this field to + files configures the delegation of gids to + /etc/subgid. Setting any other value treats + the delegation as a plugin following with a name of the form + libsubid_$value.so. If the value or plugin is + missing, then the subordinate gid delegation falls back to + files. + + + Note, that groupadd will only create entries in + /etc/subgid if subid delegation is managed via subid + files. + + + + + LOCAL SUBORDINATE DELEGATION Each line in /etc/subgid contains a user name and a range of subordinate group ids that user diff --git a/man/subuid.5.xml b/man/subuid.5.xml index ec6a85f5..990d162e 100644 --- a/man/subuid.5.xml +++ b/man/subuid.5.xml @@ -38,6 +38,11 @@ Biederman Creation, 2013 + + Iker + Pedrosa + Developer, 2021 + subuid @@ -48,11 +53,36 @@ subuid - the subordinate uid file + the configuration for subordinate user ids DESCRIPTION + + Subuid authorizes a user id to map ranges of user ids from its namespace + into child namespaces. + + + The delegation of the subordinate uids can be configured via the + subid field in + /etc/nsswitch.conf file. Only one value can be set + as the delegation source. Setting this field to + files configures the delegation of uids to + /etc/subuid. Setting any other value treats + the delegation as a plugin following with a name of the form + libsubid_$value.so. If the value or plugin is + missing, then the subordinate uid delegation falls back to + files. + + + Note, that useradd will only create entries in + /etc/subuid if subid delegation is managed via subid + files. + + + + + LOCAL SUBORDINATE DELEGATION Each line in /etc/subuid contains a user name and a range of subordinate user ids that user