Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <CAKdAkRQj=bSSL2Cw3gAqi5f12yP3+KsvtrMvU4Lcfta_JYxMYQ@mail.gmail.com>
 <20190328180503.GA16249@mail.hallyn.com>
In-Reply-To: <20190328180503.GA16249@mail.hallyn.com>
From:   Dmitry Torokhov <dmitry.torokhov@gmail.com>
Date:   Thu, 28 Mar 2019 11:30:52 -0700
Message-ID: <CAKdAkRRf+7UkmwbWNEnR3cNhc2t-kspRQNy4uOYRdcwBofXwtA@mail.gmail.com>
Subject: Re: Allowing mapping supplemental groups in user namespace?
To:     "Serge E. Hallyn" <serge@hallyn.com>
Cc:     "Eric W. Biederman" <ebiederm@xmission.com>,
        lkml <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Serge,

On Thu, Mar 28, 2019 at 11:05 AM Serge E. Hallyn <serge@hallyn.com> wrote:
>
> On Thu, Feb 28, 2019 at 11:27:38AM -0800, Dmitry Torokhov wrote:
> > Hi Eric,
> >
> > Currently, unless caller has CAP_SETGID in parent namespace, we can
> > only map effective group id in the new user namespace. Would it be
> > possible to relax this rule to also allow mapping of supplemental
> > groups (1:1) of the caller?
> >
> > Thanks.
> >
> > --
> > Dmitry
>
> Hi,
>
> Is there a use case where adding those to /etc/subgid is onerous?
> (There probably is, just would like to see yours)

We on Chrome OS limit number of suid binaries installed on the system,
so newgidmap does not have necessary privileges to carry out this
operation. Also we are looking for a solution that we can use with our
minijail package where spawning additional binary is challenging even
if it was suid.

Thanks.

-- 
Dmitry


-- 
Dmitry