From: Zbigniew Jędrzejewski-Szmek Date: Tue, 9 Jan 2024 11:10:18 +0000 (+0100) Subject: docs/UID-GIDS: mention that ranges are actually configurable X-Git-Tag: v256-rc1~1004^2~1 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=7e4f30c3d0008355c4df8c2d2d84ceef378eee4a;p=thirdparty%2Fsystemd.git docs/UID-GIDS: mention that ranges are actually configurable It silly for our docs to say that they aren't when we added support for this a few years ago. Also, drop some mentions of "runtime". This implied that those values can be changed almost at will, but actually, they can only be meaningfully changed _before_ the allocations are made. --- diff --git a/docs/UIDS-GIDS.md b/docs/UIDS-GIDS.md index 28f3672a37a..ab302c044a3 100644 --- a/docs/UIDS-GIDS.md +++ b/docs/UIDS-GIDS.md @@ -21,7 +21,7 @@ validity for GIDs too. In theory, the range of the C type `uid_t` is 32-bit wide on Linux, i.e. 0…4294967295. However, four UIDs are special on Linux: -1. 0 → The `root` super-user +1. 0 → The `root` super-user. 2. 65534 → The `nobody` UID, also called the "overflow" UID or similar. It's where various subsystems map unmappable users to, for example file systems @@ -57,20 +57,20 @@ Distributions generally split the available UID range in two: 2. 1000…65533 and 65536…4294967294 → Everything else, i.e. regular (human) users. -Note that most distributions allow changing the boundary between system and -regular users, even during runtime as user configuration. Moreover, some older -systems placed the boundary at 499/500, or even 99/100. In `systemd`, the -boundary is configurable only during compilation time, as this should be a -decision for distribution builders, not for users. Moreover, we strongly -discourage downstreams to change the boundary from the upstream default of -999/1000. +Some older systems placed the boundary at 499/500, or even 99/100, +and some distributions allow the boundary between system and regular users to be changed +via local configuration. +In `systemd`, the boundary is configurable during compilation time +and is also queried from `/etc/login.defs` at runtime, +if the `-Dcompat-mutable-uid-boundaries=true` compile-time setting is used. +We strongly discourage downstreams from changing the boundary from the upstream default of 999/1000. Also note that programs such as `adduser` tend to allocate from a subset of the -available regular user range only, usually 1000..60000. And it's also usually -user-configurable, too. +available regular user range only, usually 1000..60000. +This range can also be configured using `/etc/login.defs`. Note that systemd requires that system users and groups are resolvable without -networking available — a requirement that is not made for regular users. This +network — a requirement that is not made for regular users. This means regular users may be stored in remote LDAP or NIS databases, but system users may not (except when there's a consistent local cache kept, that is available during earliest boot, including in the initrd).