From 021ba941513f8135ad4df8272b18abc7cc24ff03 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Tue, 5 Sep 2023 22:05:11 +0200 Subject: [PATCH] config.md: allow empty mappings for [r]idmap crun currently allows to specify an empty mapping for [r]idmap, and to default to the mappings specified for the container user namespace. Change the specifications to allow such behavior. Signed-off-by: Giuseppe Scrivano --- config.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config.md b/config.md index 4f03f4fce..27aa15e1f 100644 --- a/config.md +++ b/config.md @@ -151,8 +151,8 @@ Runtimes MUST/SHOULD/MAY implement the following option strings for Linux: `sync` | MUST | [^1] `tmpcopyup` | MAY | copy up the contents to a tmpfs `unbindable` | MUST | Bind mount propagation [^2] - `idmap` | SHOULD | Indicates that the mount has `uidMappings` and `gidMappings` specified. This option SHOULD NOT be passed to the underlying [`mount(2)`][mount.2] call. If supported, the runtime MUST return an error if this option is provided and either of `uidMappings` or `gidMappings` are empty or not present. - `ridmap` | SHOULD | Indicates that the mount has `uidMappings` and `gidMappings` specified, and the mapping is applied recursively [^3]. This option SHOULD NOT be passed to the underlying [`mount(2)`][mount.2] call. If supported, the runtime MUST return an error if this option is provided and either of `uidMappings` or `gidMappings` are empty or not present. + `idmap` | SHOULD | Indicates that the mount MUST have an idmapping applied. This option SHOULD NOT be passed to the underlying [`mount(2)`][mount.2] call. If `uidMappings` or `gidMappings` are specified for the mount, the runtime MUST use those values for the mount's mapping. If they are not specified, the runtime MAY use the container's user namespace mapping, otherwise an [error MUST be returned](runtime.md#errors). If there are no `uidMappings` and `gidMappings` specified and the container isn't using user namespaces, an [error MUST be returned](runtime.md#errors). This SHOULD be implemented using [`mount_setattr(MOUNT_ATTR_IDMAP)`][mount_setattr.2], available since Linux 5.12. + `ridmap` | SHOULD | Indicates that the mount MUST have an idmapping applied, and the mapping is applied recursively [^3]. This option SHOULD NOT be passed to the underlying [`mount(2)`][mount.2] call. If `uidMappings` or `gidMappings` are specified for the mount, the runtime MUST use those values for the mount's mapping. If they are not specified, the runtime MAY use the container's user namespace mapping, otherwise an [error MUST be returned](runtime.md#errors). If there are no `uidMappings` and `gidMappings` specified and the container isn't using user namespaces, an [error MUST be returned](runtime.md#errors). This SHOULD be implemented using [`mount_setattr(MOUNT_ATTR_IDMAP)`][mount_setattr.2], available since Linux 5.12. [^1]: Corresponds to [`mount(8)` (filesystem-independent)][mount.8-filesystem-independent]. [^2]: Corresponds to [bind mounts and shared subtrees][mount-bind].