Re: [gentoo-dev] Don't use UIDs and GIDs below 100 without QA approval

[Mike Gilbert]

On Thu, Nov 11, 2021 at 5:59 AM Ulrich Mueller <ulm@g.o> wrote:
>
> May I remind everybody that by QA policy allocation of UIDs and GIDs
> in the range 0..100 needs explicit approval by the QA lead:
> https://projects.gentoo.org/qa/policy-guide/user-group.html#pg0901
>
> I have fixed the used_free_uidgids.sh script such that it will no longer
> recommend any IDs below 101.
>
> In any case, we have run out of GIDs:
>
>    Recommended GID only: none
>    Recommended UID only: 272
>    Recommended UID+GID pair: none
>    Free UIDs: 15
>    Free GIDs: 0
>    Free UID+GID pairs: 0
>
> The question is of course how we should move forward. Certainly, using
> IDs below 100 cannot be the solution, as we would run out of these very
> soon.
>
> We could:
>
> - Open some part of the range between 500 and 1000. For example,
>   500..799, which would leave 200 IDs for dynamic allocation.

This sounds like the simplest solution to me.

> - Open part of the range 60001..65533. Not sure if all software will be
>   happy with that.

systemd has some code that special-cases ids in the "system" range.
I'm not exactly sure what impact creating system users outside above
SYS_UID_MAX (login.defs) will have.