Allow --uid and --gid without --unshare-user when running as root

[daandemeyer]

When root, it's not necessary to --unshare-user to be able to change uid/gid, so bubblewrap shouldn't require it.

[rusty-snake]

FWIW: --uid/--gid change the uid/gid by mapping the outer id to the specified id in the new user-ns (i.e. they do not call setuid/setgid).

[smcv]

Do you have a use-case in mind for this? If yes, what?

A large part of the point of bubblewrap is that it works when you're not root. If you are root, there are lots of other ways to achieve similar results, like setpriv. Given its limited maintainer bandwidth (for the last year it has mostly just been me), I think we should keep bubblewrap somewhat focused on the things that can't be done any other way.

As @rusty-snake said, I don't think the way we are implementing --uid/--gid can work when not creating a new userns. If we have CAP_SETUID and CAP_SETGID, then we could have a different code path that does work without creating a new userns; but we would have to be very careful to make sure that an adversarial user couldn't make use of that code path to trick a setuid bwrap into opening up security holes.

[Jturnerusa]

I actually do have a use case here, just a simple script that runs as root, sets up a chroot and binds some stuff in, and then should be able to drop to a different user than root.

Podman and such can do this already I think, and I am sort of using bwrap as a replacement for those for making containers, so it would be nice to have this option.

Without bwrap I would need to use unshare(1) directly, and handle a lot more stuff manually, which is an option but not great.

I'm curious what the security implications for this are so long as it's only available when actually running as root?

[axelfontaine]

@Jturnerusa That's exactly how I implemented it in #616 . We've been using the code from that PR in production without any issues for over a year.

I'm curious what the security implications for this are so long as it's only available when actually running as root?

I asked the same question to @smcv about his possible concerns in the PR discussion, but never got an answer.