Reserving a range of anonymous UIDs; /etc/subuid

Question

I need a range of uids (say a few thousand) for a setuid-root tool to use. Is there a protocol to registering such a range or do I just pick a range and hope no other program will use those uids?

(I'd rather not create not clutter /etc/passwd with this.)

I came across /etc/subuid (among other places documented in https://www.mankier.com/8/usermod ) and it seems like that does something similar. What exactly is /etc/subuid, and can I use it to register a range for my setuid tool?

It appears this /etc/subuid stuff is used by docker for some kind of uid-mapping. If I create a new user for my app, reserve a subid range for it via /etc/subuid and then not use it with docker, would that be a good way to let the rest of the system know I've reserved a uid range?

Answer 1

There is a hack, and then there is a way to do this right.

The hacky way is to raise UID_MIN and GID_MIN in /etc/login.defs so that your reserved UIDs fall between SYS_UID_MAX and UID_MIN, and GIDs (if any) between SYS_GID_MAX and GID_MIN. That way normal tools (useradd, adduser, usermod, etc.) do not use them for new user accounts, unless you force them to (by explicitly specifying the new UID and/or GID). You may need to remap any existing UIDs in this new gap range to the UID_MIN..UID_MAX range, and GIDs to the GID_MIN..GID_MAX range, so that tools treat them as normal user accounts.

The right way is to additionally configure NSS (and PAM, usually) to see these reserved users, so that tools do not get confused.

The simplest way to do this is to use libnss-extrausers NSS module, and pam_extrausers PAM module, so that you can put these special users in /var/lib/extrausers/passwd (and no-password entries in /var/lib/extrausers/shadow), plus optionally group information in /var/lib/extrausers/groups. These modules should be available in all common Linux distributions.

Note that if you do add these users to NSS/PAM, you may wish to extend SYS_UID_MAX and SYS_GID_MAX to cover these reserved users, just as a precaution: You see, I haven't checked if/which tools list only the UID_MIN..UID_MAX users, or just exclude the SYS_UID_MIN..SYS_UID_MAX users. I suspect there are a lot of programmers who mistakenly believe the two sets are complements of each other, so treating these reserved UIDs/GIDs as system accounts is probably the safest option.