4

To my knowledge the subordinate UIDs and GIDs are assigned to accounts in such a manner that they form a contiguous range.

The range starts at 100000 by default and probably stretches to the theoretical maximum value for a UID/GID (even though I haven't found a way to query this from the shell, /etc/login.defs only lists the values allowed for the tools).

Now, it'd be a lot more convenient for me as a human if the ranges would start at a multiple of 100000, i.e. n*100000 with n being a positive integer (n>0), instead of 100000+n*65536. This way I'd be able to see immediately which file is owned by which host user.

Is there a way to influence the assignment of subordinate UIDs/GIDs in some way in modern enough shadow-utils to achieve a more human-readable assignment?

If not, is it alright to simply overwrite the files /etc/subuid and /etc/subgid with conforming data to get what I want?

1

Yes, this can be configured in /etc/login.defs using the SUB_UID_MIN, SUB_UID_MAX and SUB_UID_COUNT parameters and their SUB_GID_* counterparts.

All these parameters are described in login.defs(5) man page, however the default values given in this documentation are not true on all platforms.

According to the man page, a behavior similar to the one you describe should be used by default with ranges set as multiple of 10000. However this would cause issues with some system accounts and groups which are affected UID and GID above 65000 on certain platforms (Debian and derivatives for instance). Therefore the default range 65536 has been enforced with the side-effect you know.

So, to get more human readable ranges, you can explicitly set the values below in your /etc/login.defs file:

SUB_UID_MIN   100000
SUB_UID_MAX   600100000
SUB_UID_COUNT 100000
SUB_GID_MIN   100000
SUB_GID_MAX   600100000
SUB_GID_COUNT 100000

By the way, the files /etc/subuid and /etc/subgid can indeed be manually edited, but ensure that ranges do not overlap and be sure to not mess with any process, file or any other object ownership. In other words, while it is safe to do it before actually using the range, afterward it will require some special care.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.