Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

[Ulrich Mueller]

>>>>> On Thu, 11 Nov 2021, Jaco Kroon wrote:

> # getent passwd | awk -F: '{ print $3 }' | sort -g | tail -n3
> 37945
> 37946
> 65534 <-- this happens to be nobody.

> 60000 up to where?  65533?

I'd say 60001..60999 for now, and increase by another 1000 when (and if)
it will become necessary.

> I'll need to make a "hole" in our
> allocations but that's perfectly do-able.  Others may run into similar
> issues and be caught unawares (especially if UID/GID values are
> allocated from some other system which may not be aware of UID/GID
> values on specific servers).  Might be worth the trouble to head to
> >=2^31, but that will again fail on systems that still use 16-bit
> UID/GID values (I'm not aware that we still support kernels older than 2.4).

More than 16 bits may be problematic with containers. IIUC some of them
use a split scheme where the upper 16 bits are reserved.

> https://systemd.io/UIDS-GIDS/ basically says system users (which we're
> discussing here) is <1000.  systemd also already violates this statement
> itself just a few paragraphs down with special systemd UID and GID
> ranges.  And already >60000 ranges listed here (most of 60000 to 65533
> is reserved by systemd).

That's not a standard in any case, and it's dynamic allocation. So as
long as we don't fill up the whole range, things should be fine.

Ulrich