ubuntu / aad-auth

Azure AD authentication module for Ubuntu
GNU Lesser General Public License v3.0
143 stars 22 forks source link

Issue: #399 Update mod.rs, quickfix workaround #400

Open johne8 opened 9 months ago

johne8 commented 9 months ago

Workaround for issue #399 allow podman to run with --userns=keep-id

codecov[bot] commented 9 months ago

Codecov Report

Attention: 7 lines in your changes are missing coverage. Please review.

Comparison is base (8b04ff2) 83.23% compared to head (941b339) 83.10%.

Files Patch % Lines
nss/src/cache/mod.rs 74.07% 5 Missing and 2 partials :warning:
Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #400 +/- ## ========================================== - Coverage 83.23% 83.10% -0.13% ========================================== Files 36 36 Lines 2964 2983 +19 Branches 279 288 +9 ========================================== + Hits 2467 2479 +12 - Misses 377 382 +5 - Partials 120 122 +2 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.

johne8 commented 9 months ago

@johne8: thanks for looking at this and help at figuring out your issue with podman!

I don’t really like that we hardcode the ownership integer value of nobody, which can vary depending on the distribution and user config.

Secondly, this check is to ensure an integrity of the database and poking a hole there doesn’t seem like the right solution. I think looking at the user namespace mapping might help there to ensure that in the parent namespace, the uid/gid still match the expecations, wdyt?

hmm, I'm not too familiar with namespaces. The best thing I can think of currently is reading the values of: /proc/sys/kernel/overflowuid and /proc/sys/kernel/overflowgid, then check if the uid and gid owner matches that.

johne8 commented 8 months ago

Have you checked out my latest commit? It seems to work fine :)

Also in Ubuntu 22.04 LTS, it seems like UID/GID above 2147483647 (SignedInt) causes issues in gnome.

So needed to add some workaround for this also by reducing the UID of the users that have a UID calculated above that value.