From d77e98c7e85b2d0f955ca845af208a733d301bde Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Mon, 2 May 2022 15:08:43 +0800 Subject: [PATCH 1/5] fix a typo in changelog --- chapter01/changelog.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/chapter01/changelog.xml b/chapter01/changelog.xml index 7fb586b09..fd0608d02 100644 --- a/chapter01/changelog.xml +++ b/chapter01/changelog.xml @@ -44,7 +44,7 @@ 2022-05-01 - [bdubbs] - Change nobody/nogroup uid/git to 65534. + [bdubbs] - Change nobody/nogroup uid/gid to 65534. [bdubbs] - Update to meson-0.62.1. Fixes From 14de4552bfc176646e1365a1bf85035486ced218 Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Mon, 2 May 2022 15:36:03 +0800 Subject: [PATCH 2/5] explain the usage of 65534 --- chapter07/createfiles.xml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/chapter07/createfiles.xml b/chapter07/createfiles.xml index 7df2acde6..ca148f966 100644 --- a/chapter07/createfiles.xml +++ b/chapter07/createfiles.xml @@ -169,6 +169,15 @@ EOF freely by the system administrator since well-written programs do not depend on GID numbers, but rather use the group's name. + The ID 65534 is used by the kernel for NFS and separate user + namespaces for unmapped users (those exist on the NFS server or the parent + user namespace, but do not exist on the local machine or in + the separate namespace). We assign + nobody and + nogroup for it to avoid an + unnamed ID. But other distros may treat this ID differently, so any + portable program should not depend on this assignment. + Some tests in need a regular user. We add this user here and delete this account at the end of that chapter. From 8469f02115f88b071736eac9c1fcbdd16bb80cd4 Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Mon, 2 May 2022 15:39:45 +0800 Subject: [PATCH 3/5] make /etc/group sorted by GID --- chapter07/createfiles.xml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/chapter07/createfiles.xml b/chapter07/createfiles.xml index ca148f966..24557a1ef 100644 --- a/chapter07/createfiles.xml +++ b/chapter07/createfiles.xml @@ -116,8 +116,8 @@ mail:x:34: kvm:x:61: uuidd:x:80: wheel:x:97: -nogroup:x:65534: -users:x:999: +users:x:999: +nogroup:x:65534: EOF cat > /etc/group << "EOF" @@ -153,8 +153,8 @@ systemd-coredump:x:79: uuidd:x:80: systemd-oom:x:81: wheel:x:97: -nogroup:x:65534: -users:x:999: +users:x:999: +nogroup:x:65534: EOF The created groups are not part of any standard—they are groups From 0414633793e568fd49a4b1fbae74fada9ab48838 Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Mon, 2 May 2022 15:41:52 +0800 Subject: [PATCH 4/5] minor fix for 65534 explanation: it is also used for "unmapped" groups --- chapter07/createfiles.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/chapter07/createfiles.xml b/chapter07/createfiles.xml index 24557a1ef..71cb39c1f 100644 --- a/chapter07/createfiles.xml +++ b/chapter07/createfiles.xml @@ -170,9 +170,9 @@ EOF on GID numbers, but rather use the group's name. The ID 65534 is used by the kernel for NFS and separate user - namespaces for unmapped users (those exist on the NFS server or the parent - user namespace, but do not exist on the local machine or in - the separate namespace). We assign + namespaces for unmapped users and groups (those exist on the NFS server + or the parent user namespace, but do not exist on the local + machine or in the separate namespace). We assign nobody and nogroup for it to avoid an unnamed ID. But other distros may treat this ID differently, so any From 7c862eac22b81a8224a9b9c549bb2eebb3f77b7f Mon Sep 17 00:00:00 2001 From: Xi Ruoyao Date: Mon, 2 May 2022 16:02:10 +0800 Subject: [PATCH 5/5] GID 5 (for tty) is also special --- chapter07/createfiles.xml | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/chapter07/createfiles.xml b/chapter07/createfiles.xml index 71cb39c1f..eda30ed2e 100644 --- a/chapter07/createfiles.xml +++ b/chapter07/createfiles.xml @@ -165,9 +165,14 @@ EOF url="http://refspecs.linuxfoundation.org/lsb.shtml"/>) only recommends that, besides the group root with a Group ID (GID) of 0, a group bin - with a GID of 1 be present. All other group names and GIDs can be chosen - freely by the system administrator since well-written programs do not depend - on GID numbers, but rather use the group's name. + with a GID of 1 be present. The GID of 5 is widely used for + tty group, and the number 5 is + also used in systemd + /etc/fstab for the + devpts filesystem. + All other group names and GIDs can be chosen freely by the system + administrator since well-written programs do not depend on GID numbers, + but rather use the group's name. The ID 65534 is used by the kernel for NFS and separate user namespaces for unmapped users and groups (those exist on the NFS server