Issue: #399 Update mod.rs, quickfix workaround

[johne8]

Workaround for issue #399
allow podman to run with --userns=keep-id

[codecov]

Codecov Report

Attention: 7 lines in your changes are missing coverage. Please review.

Comparison is base (8b04ff2) 83.23% compared to head (941b339) 83.10%.

Files	Patch %	Lines
nss/src/cache/mod.rs	74.07%	5 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #400      +/-   ##
==========================================
- Coverage   83.23%   83.10%   -0.13%     
==========================================
  Files          36       36              
  Lines        2964     2983      +19     
  Branches      279      288       +9     
==========================================
+ Hits         2467     2479      +12     
- Misses        377      382       +5     
- Partials      120      122       +2     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[didrocks]

@johne8: thanks for looking at this and help at figuring out your issue with podman!

I don’t really like that we hardcode the ownership integer value of nobody, which can vary depending on the distribution and user config.

Secondly, this check is to ensure an integrity of the database and poking a hole there doesn’t seem like the right solution. I think looking at the user namespace mapping might help there to ensure that in the parent namespace, the uid/gid still match the expecations, wdyt?

[johne8]

@johne8: thanks for looking at this and help at figuring out your issue with podman!

I don’t really like that we hardcode the ownership integer value of nobody, which can vary depending on the distribution and user config.

Secondly, this check is to ensure an integrity of the database and poking a hole there doesn’t seem like the right solution. I think looking at the user namespace mapping might help there to ensure that in the parent namespace, the uid/gid still match the expecations, wdyt?

hmm, I'm not too familiar with namespaces. The best thing I can think of currently is reading the values of: /proc/sys/kernel/overflowuid and /proc/sys/kernel/overflowgid, then check if the uid and gid owner matches that.

[johne8]

Have you checked out my latest commit? It seems to work fine :)

Also in Ubuntu 22.04 LTS, it seems like UID/GID above 2147483647 (SignedInt) causes issues in gnome.

So needed to add some workaround for this also by reducing the UID of the users that have a UID calculated above that value.