diff options
| author | Lennart Poettering <lennart@poettering.net> | 2015-07-09 14:46:20 -0300 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2015-07-09 14:46:20 -0300 |
| commit | c01ff965b48bb9693dcd77cbc748b5d8676766b0 (patch) | |
| tree | 63e50e4f3d4b6e6d3217fa2bf7f700eb19c258de /src/machine/org.freedesktop.machine1.conf | |
| parent | 43694a8cc70667498f3ffc5d9325b7d0428558e5 (diff) | |
nss-mymachines: map userns users of containers to real user names
Given a container "foo", that maps user id $UID to container user, using
user namespaces, this NSS module extenstion will now map the $UID to a
name "vu-foo-$TUID" for the translated UID $UID.
Similar, userns groups are mapped to "vg-foo-$TGID" for translated GIDs
of $GID.
This simple change should make userns users more discoverable. Also,
given that many tools like "adduser" check NSS before allocating a UID,
should lower the chance of UID range conflicts between tools.
Diffstat (limited to 'src/machine/org.freedesktop.machine1.conf')
| -rw-r--r-- | src/machine/org.freedesktop.machine1.conf | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/src/machine/org.freedesktop.machine1.conf b/src/machine/org.freedesktop.machine1.conf index 93aaf6a377..d58f01507b 100644 --- a/src/machine/org.freedesktop.machine1.conf +++ b/src/machine/org.freedesktop.machine1.conf @@ -113,6 +113,22 @@ send_member="SetImageLimit"/> <allow send_destination="org.freedesktop.machine1" + send_interface="org.freedesktop.machine1.Manager" + send_member="MapFromMachineUser"/> + + <allow send_destination="org.freedesktop.machine1" + send_interface="org.freedesktop.machine1.Manager" + send_member="MapToMachineUser"/> + + <allow send_destination="org.freedesktop.machine1" + send_interface="org.freedesktop.machine1.Manager" + send_member="MapFromMachineGroup"/> + + <allow send_destination="org.freedesktop.machine1" + send_interface="org.freedesktop.machine1.Manager" + send_member="MapToMachineGroup"/> + + <allow send_destination="org.freedesktop.machine1" send_interface="org.freedesktop.machine1.Machine" send_member="GetAddresses"/> |