Fix id mappings

[Mashimiao]

1. the limit depends on different kernel version and not definitely required by spec

[zhouhao3]

LGTM

[wking]

On Sat, Dec 02, 2017 at 05:48:16AM +0000, Ma Shimiao wrote: 1. the limit depends on different kernel version and not definitely required by spec

+1 to this, so I'm in favor of your validate.go change.

2. uid and gid mappings must be set together

You're at least allowed to write uid_map without writing gid_map. As an unprivileged user running ccon [1]: $ cat config.json { "version": "0.4.0", "namespaces": { "user": { "uidMappings": [ { "containerID": 0, "hostID": 1000, "size": 1 } ] } }, "process": { "args": [ "busybox", "id" ] } } $ ccon uid=0(root) gid=65534(nobody) groups=65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody),65534(nobody) The above config maps my unprivileged user 1000 to 0 but left the groups unmapped. And ‘busybox id’ can't handle it, but you can also map the group while leaving the user unmapped: $ cat config.json { "version": "0.4.0", "namespaces": { "user": { "setgroups": false, "gidMappings": [ { "containerID": 0, "hostID": 1000, "size": 1 } ] } }, "process": { "args": [ "/bin/echo", "hello" ] } } $ ccon hello so I'm not in favor of your validation changes. This may also be related to your opencontainers/runc#1665 PR. [1]: https://github.com/wking/ccon

[Mashimiao]

I think unmapped users or groups may cause operation or security problem. But that needs to talk in runtime-spec. Just remove mapping limit this time.

[zhouhao3]

LGTM

[liangchenye]

LGTM