From: Serge Hallyn <serge.hallyn@ubuntu.com>
Date: Mon, 15 Sep 2014 00:35:02 +0000 (+0000)
Subject: lxc_map_ids: add a comment
X-Git-Tag: lxc-1.0.6~9
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b682262f1ff0303f3123ba6f4ca90f6f840ba338;p=thirdparty%2Flxc.git

lxc_map_ids: add a comment

Explain why we insist that root use newuidmap if it is available.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
---

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index a642d8603..db82b7c9b 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3361,6 +3361,12 @@ int lxc_map_ids(struct lxc_list *idmap, pid_t pid)
 	enum idtype type;
 	char *buf = NULL, *pos, *cmdpath = NULL;
 
+	/*
+	 * If newuidmap exists, that is, if shadow is handing out subuid
+	 * ranges, then insist that root also reserve ranges in subuid.  This
+	 * will protected it by preventing another user from being handed the
+	 * range by shadow.
+	 */
 	cmdpath = on_path("newuidmap");
 	if (cmdpath) {
 		use_shadow = 1;