[PATCH 00/11] pkg-shadow support subordinate ids with user namespaces

[Rob Landley]

I am waaaay behind on email.

On 01/22/2013 03:11:19 AM, Eric W. Biederman wrote:
> 
> The kernel support for user namespaces allows ordinary users to use
> multiple uids and gids if they can get a trusted program to tell the
> kernel the set of subordinate uids and gids they are allowed to use.

Could you give an example of this? (If this takes off I'll probably  
want to add support to toybox, but from the man pages I don't  
understand what it's for.)

> This is my work to make that trusted program.
> Two new files are added /etc/subuid /etc/subgid that specify
> ranges of uids and gids that users may uses.

They must use a contiguous range with count, not  
"landley:4000-4999,6103,7002-7005"?

> useradd, and newusers are modifed to add users to those files.
> userdel is modeifed to remove users from those files.
> usermod is modified to give manual control of what goes in those  
> files.

> newuidmap and newgidmap read the new files and update
> /proc/[pid]/uid_map and /proc/[pid]/gid_map respectively
> as requested by their command line parameters and as allowed
> by the /etc/subuid and /etc/subgid.

I'm not finding uid_map and gid_map in  
Documentation/filesystems/proc.txt, is this a pending patch?

Rob