subid: Define settings for deterministic wrap subid ranges

They are not active at this commit, but they are documented.

Signed-off-by: Pat Riehecky <riehecky@fnal.gov>

diff --git a/etc/login.defs b/etc/login.defs
index 192ea8515db71857ea6abef444bece463db09ac5..5d9b9daf28e468a00ce0285dbc3f221544a5abc8 100644 (file)
--- a/etc/login.defs
+++ b/etc/login.defs
@@ -257,6 +257,24 @@ SUB_UID_COUNT                  65536
 #
 #SUB_UID_DETERMINISTIC no
 
+#
+# Allow deterministic subordinate UID calculation to wrap around using
+# modulo arithmetic when a UID would overflow the configured subordinate
+# ID space. Only effective when SUB_UID_DETERMINISTIC is "yes".
+#
+# When disabled (default), any arithmetic overflow is a hard error,
+# ensuring non-overlapping monotonic allocation.
+#
+# WARNING: SECURITY RISK - MAY CAUSE RANGE OVERLAPS AND PRIVILEGE ESCALATION!
+#
+# When enabled (WRAP MODE), the subordinate ID space is treated as a ring
+# buffer. Uses modulo arithmetic to handle overflow. May cause range
+# overlaps between users.
+#
+# Default: no
+#
+#UNSAFE_SUB_UID_DETERMINISTIC_WRAP     no
+
 #
 # Min/max values for automatic gid selection in groupadd(8)
 #
@@ -287,6 +305,24 @@ SUB_GID_COUNT                  65536
 #
 #SUB_GID_DETERMINISTIC no
 
+#
+# Allow deterministic subordinate GID calculation to wrap around using
+# modulo arithmetic when a UID would overflow the configured subordinate
+# ID space. Only effective when SUB_GID_DETERMINISTIC is "yes".
+#
+# When disabled (default), any arithmetic overflow is a hard error,
+# ensuring non-overlapping monotonic allocation.
+#
+# WARNING: SECURITY RISK - MAY CAUSE RANGE OVERLAPS AND PRIVILEGE ESCALATION!
+#
+# When enabled (WRAP MODE), the subordinate ID space is treated as a ring
+# buffer. Uses modulo arithmetic to handle overflow. May cause range
+# overlaps between users.
+#
+# Default: no
+#
+#UNSAFE_SUB_GID_DETERMINISTIC_WRAP      no
+
 #
 # Max number of login(1) retries if password is bad
 #

diff --git a/lib/getdef.c b/lib/getdef.c
index c18b05189649ed46aba1942b98ec72141549f445..02fd663ed2d3490bbe06cde04f89b4239c76764d 100644 (file)
--- a/lib/getdef.c
+++ b/lib/getdef.c
@@ -143,6 +143,8 @@ static struct itemdef def_table[] = {
        {"UID_MAX", NULL},
        {"UID_MIN", NULL},
        {"UMASK", NULL},
+       {"UNSAFE_SUB_GID_DETERMINISTIC_WRAP", NULL},
+       {"UNSAFE_SUB_UID_DETERMINISTIC_WRAP", NULL},
        {"USERDEL_CMD", NULL},
        {"USERGROUPS_ENAB", NULL},
 #ifndef USE_PAM

diff --git a/man/login.defs.5.xml b/man/login.defs.5.xml
index db258c371d83660a84a05595e2aa24bd0319b5d5..aaf09f017680e2b3e00e9baf31b709902fcd23fe 100644 (file)
--- a/man/login.defs.5.xml
+++ b/man/login.defs.5.xml
@@ -205,9 +205,9 @@
       &SULOG_FILE;
       &SU_NAME;
       &SU_WHEEL_ONLY;
-      &SUB_GID_COUNT; <!-- documents also SUB_GID_MIN SUB_GID_MAX SUB_GID_DETERMINISTIC -->
+      &SUB_GID_COUNT; <!-- documents also SUB_GID_MIN SUB_GID_MAX SUB_GID_DETERMINISTIC UNSAFE_SUB_GID_DETERMINISTIC_WRAP -->
       &SUB_GID_STORE_BY_UID;
-      &SUB_UID_COUNT; <!-- documents also SUB_UID_MIN SUB_UID_MAX SUB_UID_DETERMINISTIC -->
+      &SUB_UID_COUNT; <!-- documents also SUB_UID_MIN SUB_UID_MAX SUB_UID_DETERMINISTIC UNSAFE_SUB_UID_DETERMINISTIC_WRAP -->
       &SUB_UID_STORE_BY_UID;
       &SYS_GID_MAX; <!-- documents also SYS_GID_MIN -->
       &SYS_UID_MAX; <!-- documents also SYS_UID_MIN -->
@@ -396,6 +396,7 @@
            SUB_UID_STORE_BY_UID
            SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX SYS_UID_MIN UID_MAX UID_MIN
            UMASK
+           UNSAFE_SUB_GID_DETERMINISTIC_WRAP UNSAFE_SUB_UID_DETERMINISTIC_WRAP
            <phrase condition="yescrypt">YESCRYPT_COST_FACTOR</phrase>
          </para>
        </listitem>
@@ -482,6 +483,7 @@
            SUB_UID_STORE_BY_UID
            SYS_GID_MAX SYS_GID_MIN SYS_UID_MAX SYS_UID_MIN UID_MAX UID_MIN
            UMASK
+           UNSAFE_SUB_GID_DETERMINISTIC_WRAP UNSAFE_SUB_UID_DETERMINISTIC_WRAP
            <phrase condition="tcb">TCB_AUTH_GROUP TCB_SYMLINK USE_TCB</phrase>
          </para>
        </listitem>
@@ -504,6 +506,7 @@
            MAIL_DIR MAIL_FILE MAX_MEMBERS_PER_GROUP
            SUB_GID_COUNT SUB_GID_MAX SUB_GID_MIN SUB_GID_DETERMINISTIC
            SUB_UID_COUNT SUB_UID_MAX SUB_UID_MIN SUB_UID_DETERMINISTIC
+           UNSAFE_SUB_GID_DETERMINISTIC_WRAP UNSAFE_SUB_UID_DETERMINISTIC_WRAP
            <phrase condition="tcb">TCB_SYMLINKS USE_TCB</phrase>
          </para>
        </listitem>

diff --git a/man/login.defs.d/SUB_GID_COUNT.xml b/man/login.defs.d/SUB_GID_COUNT.xml
index 884dc45e7120fadb661596464dc1c8014ee51108..4676f51ea871f170a8fa6e2e74fdbc5d6750d33e 100644 (file)
--- a/man/login.defs.d/SUB_GID_COUNT.xml
+++ b/man/login.defs.d/SUB_GID_COUNT.xml
@@ -147,3 +147,49 @@
     </refsect2>
   </listitem>
 </varlistentry>
+<varlistentry condition="subids">
+  <term><option>UNSAFE_SUB_GID_DETERMINISTIC_WRAP</option> (boolean)</term>
+  <listitem>
+    <para>
+      <emphasis role="bold">
+        WARNING: SECURITY RISK - MAY CAUSE RANGE OVERLAPS AND PRIVILEGE ESCALATION!
+      </emphasis>
+    </para>
+    <para>
+      Only effective when <option>SUB_GID_DETERMINISTIC</option> is set to
+      <replaceable>yes</replaceable>.
+    </para>
+    <para>
+      When set to <replaceable>yes</replaceable> (WRAP MODE),
+      allows the deterministic range calculation to wrap around using
+      modulo arithmetic when a UID would overflow the configured subordinate ID space.
+      The subordinate ID space is treated as a ring buffer.
+    </para>
+    <para>
+      <emphasis role="bold">WARNING</emphasis>:
+        Range overlaps can lead to container escapes and privilege escalation.
+        For example, with
+          <option>SUB_GID_MIN</option>=100000,
+          <option>SUB_GID_MAX</option>=200000,
+          <option>SUB_GID_COUNT</option>=65536,
+      User A (UID 1000) gets range [100000, 165535] and
+      User B (UID 1001) wraps and overlaps with User A.
+      User B's container can now access files from User A's containers.
+    </para>
+    <para>
+      Use <emphasis role="bold">only</emphasis> in development, testing,
+      or tightly constrained lab environments.
+    </para>
+    <para>
+      When set to <replaceable>no</replaceable> (default),
+      any arithmetic overflow or range exceeding
+      <option>SUB_GID_MAX</option> is a hard error.
+      This guarantees non-overlapping, monotonic allocation.
+    </para>
+    <para>
+      The default value for
+      <option>UNSAFE_SUB_GID_DETERMINISTIC_WRAP</option> is
+      <replaceable>no</replaceable>.
+    </para>
+  </listitem>
+</varlistentry>

diff --git a/man/login.defs.d/SUB_UID_COUNT.xml b/man/login.defs.d/SUB_UID_COUNT.xml
index 15e9fb7a84f5b3214c1624263071610b07f0f10d..3f5f33fda4ee4cfe5c0260c98e0b8e058d4d71c0 100644 (file)
--- a/man/login.defs.d/SUB_UID_COUNT.xml
+++ b/man/login.defs.d/SUB_UID_COUNT.xml
@@ -147,3 +147,49 @@
     </refsect2>
   </listitem>
 </varlistentry>
+<varlistentry condition="subids">
+  <term><option>UNSAFE_SUB_UID_DETERMINISTIC_WRAP</option> (boolean)</term>
+  <listitem>
+    <para>
+      <emphasis role="bold">
+        WARNING: SECURITY RISK - MAY CAUSE RANGE OVERLAPS AND PRIVILEGE ESCALATION!
+      </emphasis>
+    </para>
+    <para>
+      Only effective when <option>SUB_UID_DETERMINISTIC</option> is set to
+      <replaceable>yes</replaceable>.
+    </para>
+    <para>
+      When set to <replaceable>yes</replaceable> (WRAP MODE),
+      allows the deterministic range calculation to wrap around using
+      modulo arithmetic when a UID would overflow the configured subordinate ID space.
+      The subordinate ID space is treated as a ring buffer.
+    </para>
+    <para>
+      <emphasis role="bold">WARNING</emphasis>:
+        Range overlaps can lead to container escapes and privilege escalation.
+        For example, with
+          <option>SUB_UID_MIN</option>=100000,
+          <option>SUB_UID_MAX</option>=200000,
+          <option>SUB_UID_COUNT</option>=65536,
+      User A (UID 1000) gets range [100000, 165535] and
+      User B (UID 1001) wraps and overlaps with User A.
+      User B's container can now access files from User A's containers.
+    </para>
+    <para>
+      Use <emphasis role="bold">only</emphasis> in development, testing,
+      or tightly constrained lab environments.
+    </para>
+    <para>
+      When set to <replaceable>no</replaceable> (default),
+      any arithmetic overflow or range exceeding
+      <option>SUB_UID_MAX</option> is a hard error.
+      This guarantees non-overlapping, monotonic allocation.
+    </para>
+    <para>
+      The default value for
+      <option>UNSAFE_SUB_UID_DETERMINISTIC_WRAP</option> is
+      <replaceable>no</replaceable>.
+    </para>
+  </listitem>
+</varlistentry>