Fix rootfull builds - #4462
Open
behrmann wants to merge 9 commits into
Open
Fix rootfull builds#4462behrmann wants to merge 9 commits into
behrmann wants to merge 9 commits into
Conversation
This makes it easier to see that unlike the other things around, it is an integer instead of a boolean.
This is closer to the key in the varlink interface (delegateContainerRanges) and invokes that it's an integer better, since it says what to delegate instead of just to delegate.
The check in acquire_privileges checks for non-zero number of delegations, so for root this will always try to acquire UID ranges via nsresourced.
This allows to set the number of delegated ranges independently of whether mkosi runs unprivileged or as root.
This makes it easier to see what path is being taken without running the full debug output.
behrmann
marked this pull request as ready for review
September 16, 2026 15:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a followup to 7a17541 and #4444 and adds a few knobs.
The default remains unchanged when mkosi is run as an unprivileged user and we try to acquire a delegation from nsresourced. When run as root, the default number of delegated subranges is set to zero and the foreign UID range is only used when explicitly requested, which leads to an early exit in
acquire_privilegeswhich is akin to the early exit pre 7a17541. To have root request delegated subranges as well, a new optionDelegateRanges=is added.The opt out for nsresourced via the
MKOSI_FORCE_USERNS_FALLBACK"is reworked so that it is equivalent to getting a connection refused from nsresourced and trigger the fallback path in the same manner.There is some more assorted fixlets and cosmetic changes around,
ForeignUIDRange=is added to the summary, an unused variable is dropped, and an argument foracquire_privilegesis renamed, so I can see it's an int instead of a bool without looking at the function signature.Fixes: #4452
Fixes: #4233
Closes: #4268