Blame SOURCES/shadow-4.6-man_clarify_subid_delegation.patch

9ed61c
diff -up shadow-4.6/man/newgidmap.1.xml.man_clarify_subid_delegation shadow-4.6/man/newgidmap.1.xml
9ed61c
--- shadow-4.6/man/newgidmap.1.xml.man_clarify_subid_delegation	2021-11-03 09:58:34.176484342 +0100
9ed61c
+++ shadow-4.6/man/newgidmap.1.xml	2021-11-03 09:58:34.191484452 +0100
9ed61c
@@ -80,10 +80,15 @@
9ed61c
   <refsect1 id='description'>
9ed61c
     <title>DESCRIPTION</title>
9ed61c
     <para>
9ed61c
-      The <command>newgidmap</command> sets <filename>/proc/[pid]/gid_map</filename> based on its
9ed61c
-      command line arguments and the gids allowed (either in <filename>/etc/subgid</filename> or
9ed61c
-      through the configured NSS subid module).
9ed61c
-      Note that the root user is not exempted from the requirement for a valid
9ed61c
+      The <command>newgidmap</command> sets <filename>/proc/[pid]/gid_map</filename>
9ed61c
+      based on its command line arguments and the gids allowed. Subgid
9ed61c
+      delegation can either be managed via <filename>/etc/subgid</filename>
9ed61c
+      or through the configured NSS subid module. These options are mutually
9ed61c
+      exclusive.
9ed61c
+    </para>
9ed61c
+
9ed61c
+    <para>
9ed61c
+      Note that the root group is not exempted from the requirement for a valid
9ed61c
       <filename>/etc/subgid</filename> entry.
9ed61c
     </para>
9ed61c
 
9ed61c
diff -up shadow-4.6/man/newuidmap.1.xml.man_clarify_subid_delegation shadow-4.6/man/newuidmap.1.xml
9ed61c
--- shadow-4.6/man/newuidmap.1.xml.man_clarify_subid_delegation	2021-11-03 09:58:34.176484342 +0100
9ed61c
+++ shadow-4.6/man/newuidmap.1.xml	2021-11-03 09:58:34.191484452 +0100
9ed61c
@@ -80,9 +80,14 @@
9ed61c
   <refsect1 id='description'>
9ed61c
     <title>DESCRIPTION</title>
9ed61c
     <para>
9ed61c
-      The <command>newuidmap</command> sets <filename>/proc/[pid]/uid_map</filename> based on its
9ed61c
-      command line arguments and the uids allowed (either in <filename>/etc/subuid</filename> or
9ed61c
-      through the configured NSS subid module).
9ed61c
+      The <command>newuidmap</command> sets <filename>/proc/[pid]/uid_map</filename>
9ed61c
+      based on its command line arguments and the uids allowed. Subuid
9ed61c
+      delegation can either be managed via <filename>/etc/subuid</filename> or
9ed61c
+      through the configured NSS subid module. These options are mutually
9ed61c
+      exclusive.
9ed61c
+    </para>
9ed61c
+
9ed61c
+    <para>
9ed61c
       Note that the root user is not exempted from the requirement for a valid
9ed61c
       <filename>/etc/subuid</filename> entry.
9ed61c
     </para>
9ed61c
diff -up shadow-4.6/man/subgid.5.xml.man_clarify_subid_delegation shadow-4.6/man/subgid.5.xml
9ed61c
--- shadow-4.6/man/subgid.5.xml.man_clarify_subid_delegation	2018-04-29 18:42:37.000000000 +0200
9ed61c
+++ shadow-4.6/man/subgid.5.xml	2021-11-03 09:59:55.752084920 +0100
9ed61c
@@ -32,6 +32,18 @@
9ed61c
 
9ed61c
 ]>
9ed61c
 <refentry id='subgid.5'>
9ed61c
+  <refentryinfo>
9ed61c
+    <author>
9ed61c
+      <firstname>Eric</firstname>
9ed61c
+      <surname>Biederman</surname>
9ed61c
+      <contrib>Creation, 2013</contrib>
9ed61c
+    </author>
9ed61c
+    <author>
9ed61c
+      <firstname>Iker</firstname>
9ed61c
+      <surname>Pedrosa</surname>
9ed61c
+      <contrib>Developer, 2021</contrib>
9ed61c
+    </author>
9ed61c
+  </refentryinfo>
9ed61c
   <refmeta>
9ed61c
     <refentrytitle>subgid</refentrytitle>
9ed61c
     <manvolnum>5</manvolnum>
9ed61c
@@ -41,12 +53,37 @@
9ed61c
   </refmeta>
9ed61c
   <refnamediv id='name'>
9ed61c
     <refname>subgid</refname>
9ed61c
-    <refpurpose>the subordinate gid file</refpurpose>
9ed61c
+    <refpurpose>the configuration for subordinate group ids</refpurpose>
9ed61c
   </refnamediv>
9ed61c
 
9ed61c
   <refsect1 id='description'>
9ed61c
     <title>DESCRIPTION</title>
9ed61c
     <para>
9ed61c
+      Subgid authorizes a group id to map ranges of group ids from its namespace
9ed61c
+      into child namespaces.
9ed61c
+    </para>
9ed61c
+    <para>
9ed61c
+      The delegation of the subordinate gids can be configured via the
9ed61c
+      <replaceable>subid</replaceable> field in
9ed61c
+      <filename>/etc/nsswitch.conf</filename> file. Only one value can be set
9ed61c
+      as the delegation source. Setting this field to
9ed61c
+      <replaceable>files</replaceable> configures the delegation of gids to
9ed61c
+      <filename>/etc/subgid</filename>. Setting any other value treats
9ed61c
+      the delegation as a plugin following with a name of the form
9ed61c
+      <replaceable>libsubid_$value.so</replaceable>. If the value or plugin is
9ed61c
+      missing, then the subordinate gid delegation falls back to
9ed61c
+      <replaceable>files</replaceable>.
9ed61c
+    </para>
9ed61c
+    <para>
9ed61c
+      Note, that <command>groupadd</command> will only create entries in
9ed61c
+      <filename>/etc/subgid</filename> if subid delegation is managed via subid
9ed61c
+      files.
9ed61c
+    </para>
9ed61c
+  </refsect1>
9ed61c
+
9ed61c
+  <refsect1 id='local-subordinate-delegation'>
9ed61c
+    <title>LOCAL SUBORDINATE DELEGATION</title>
9ed61c
+    <para>
9ed61c
       Each line in <filename>/etc/subgid</filename> contains
9ed61c
       a user name and a range of subordinate group ids that user
9ed61c
       is allowed to use.
9ed61c
diff -up shadow-4.6/man/subuid.5.xml.man_clarify_subid_delegation shadow-4.6/man/subuid.5.xml
9ed61c
--- shadow-4.6/man/subuid.5.xml.man_clarify_subid_delegation	2018-04-29 18:42:37.000000000 +0200
9ed61c
+++ shadow-4.6/man/subuid.5.xml	2021-11-03 10:00:18.888255255 +0100
9ed61c
@@ -32,6 +32,18 @@
9ed61c
 
9ed61c
 ]>
9ed61c
 <refentry id='subuid.5'>
9ed61c
+  <refentryinfo>
9ed61c
+    <author>
9ed61c
+      <firstname>Eric</firstname>
9ed61c
+      <surname>Biederman</surname>
9ed61c
+      <contrib>Creation, 2013</contrib>
9ed61c
+    </author>
9ed61c
+    <author>
9ed61c
+      <firstname>Iker</firstname>
9ed61c
+      <surname>Pedrosa</surname>
9ed61c
+      <contrib>Developer, 2021</contrib>
9ed61c
+    </author>
9ed61c
+  </refentryinfo>
9ed61c
   <refmeta>
9ed61c
     <refentrytitle>subuid</refentrytitle>
9ed61c
     <manvolnum>5</manvolnum>
9ed61c
@@ -41,12 +53,37 @@
9ed61c
   </refmeta>
9ed61c
   <refnamediv id='name'>
9ed61c
     <refname>subuid</refname>
9ed61c
-    <refpurpose>the subordinate uid file</refpurpose>
9ed61c
+    <refpurpose>the configuration for subordinate user ids</refpurpose>
9ed61c
   </refnamediv>
9ed61c
 
9ed61c
   <refsect1 id='description'>
9ed61c
     <title>DESCRIPTION</title>
9ed61c
     <para>
9ed61c
+      Subuid authorizes a user id to map ranges of user ids from its namespace
9ed61c
+      into child namespaces.
9ed61c
+    </para>
9ed61c
+    <para>
9ed61c
+      The delegation of the subordinate uids can be configured via the
9ed61c
+      <replaceable>subid</replaceable> field in
9ed61c
+      <filename>/etc/nsswitch.conf</filename> file. Only one value can be set
9ed61c
+      as the delegation source. Setting this field to
9ed61c
+      <replaceable>files</replaceable> configures the delegation of uids to
9ed61c
+      <filename>/etc/subuid</filename>. Setting any other value treats
9ed61c
+      the delegation as a plugin following with a name of the form
9ed61c
+      <replaceable>libsubid_$value.so</replaceable>. If the value or plugin is
9ed61c
+      missing, then the subordinate uid delegation falls back to
9ed61c
+      <replaceable>files</replaceable>.
9ed61c
+    </para>
9ed61c
+    <para>
9ed61c
+      Note, that <command>useradd</command> will only create entries in
9ed61c
+      <filename>/etc/subuid</filename> if subid delegation is managed via subid
9ed61c
+      files.
9ed61c
+    </para>
9ed61c
+  </refsect1>
9ed61c
+
9ed61c
+  <refsect1 id='local-subordinate-delegation'>
9ed61c
+    <title>LOCAL SUBORDINATE DELEGATION</title>
9ed61c
+    <para>
9ed61c
       Each line in <filename>/etc/subuid</filename> contains
9ed61c
       a user name and a range of subordinate user ids that user
9ed61c
       is allowed to use.