nspawn/vmspawn: Add --bind-user-group=wheel

We want bound users to be able to elevate privileges inside the
container.

diff --git a/mkosi/__init__.py b/mkosi/__init__.py
index a7be4899abfd8da88da42601972d9d72d9a56435..a5d11d2f737fa5cfcd9289c669ba0f3159b2980b 100644 (file)
--- a/mkosi/__init__.py
+++ b/mkosi/__init__.py
@@ -4270,7 +4270,7 @@ def run_shell(args: Args, config: Config) -> None:
             cmdline += ["--bind", f"{tree.source}:{target}:norbind,{uidmap}"]
 
         if config.bind_user:
-            cmdline += ["--bind-user", getpass.getuser()]
+            cmdline += ["--bind-user", getpass.getuser(), "--bind-user-group=wheel"]
 
         if args.verb == Verb.boot and config.forward_journal:
             with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as sock:

diff --git a/mkosi/vmspawn.py b/mkosi/vmspawn.py
index edb86fd7dc8c979917543184e624d4ed484c9507..565b696ed8b9bdf2a852b583c82c10c94220890f 100644 (file)
--- a/mkosi/vmspawn.py
+++ b/mkosi/vmspawn.py
@@ -64,7 +64,7 @@ def run_vmspawn(args: Args, config: Config) -> None:
         cmdline += ["--grow-image", str(config.runtime_size)]
 
     if config.bind_user:
-        cmdline += ["--bind-user", getpass.getuser()]
+        cmdline += ["--bind-user", getpass.getuser(), "--bind-user-group=wheel"]
 
     if config.runtime_network == Network.user:
         cmdline += ["--network-user-mode"]