From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <f.weber@proxmox.com> Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by lists.proxmox.com (Postfix) with ESMTPS id 96E2190C27 for <pve-devel@lists.proxmox.com>; Thu, 16 Mar 2023 16:08:07 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 76DF372C4 for <pve-devel@lists.proxmox.com>; Thu, 16 Mar 2023 16:07:37 +0100 (CET) Received: from proxmox-new.maurer-it.com (proxmox-new.maurer-it.com [94.136.29.106]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by firstgate.proxmox.com (Proxmox) with ESMTPS for <pve-devel@lists.proxmox.com>; Thu, 16 Mar 2023 16:07:36 +0100 (CET) Received: from proxmox-new.maurer-it.com (localhost.localdomain [127.0.0.1]) by proxmox-new.maurer-it.com (Proxmox) with ESMTP id 72AD444112 for <pve-devel@lists.proxmox.com>; Thu, 16 Mar 2023 16:07:35 +0100 (CET) Message-ID: <c8b026af-8256-0493-f346-e56d0afab280@proxmox.com> Date: Thu, 16 Mar 2023 16:07:34 +0100 MIME-Version: 1.0 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Thunderbird/102.8.0 Content-Language: en-US To: Wolfgang Bumiller <w.bumiller@proxmox.com> Cc: pve-devel@lists.proxmox.com References: <20230223170302.3014798-1-f.weber@proxmox.com> <20230316135936.hhr7jmw5nnkhdqa5@casey.proxmox.com> From: Friedrich Weber <f.weber@proxmox.com> In-Reply-To: <20230316135936.hhr7jmw5nnkhdqa5@casey.proxmox.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.439 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment NICE_REPLY_A -0.001 Looks like a legit reply (A) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: Re: [pve-devel] [PATCH container] lxc start: warn in case of conflicting lxc.idmap entries X-BeenThere: pve-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox VE development discussion <pve-devel.lists.proxmox.com> List-Unsubscribe: <https://lists.proxmox.com/cgi-bin/mailman/options/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=unsubscribe> List-Archive: <http://lists.proxmox.com/pipermail/pve-devel/> List-Post: <mailto:pve-devel@lists.proxmox.com> List-Help: <mailto:pve-devel-request@lists.proxmox.com?subject=help> List-Subscribe: <https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel>, <mailto:pve-devel-request@lists.proxmox.com?subject=subscribe> X-List-Received-Date: Thu, 16 Mar 2023 15:08:07 -0000 Thanks for the review! On 16/03/2023 14:59, Wolfgang Bumiller wrote: > Both seem a bit excessive to me. > > Let's look at the data: > We have a set of ranges consisting of a type, 2 starts and a count. > The types are uids and gids, so we can view those as 2 separate > instances of sets of [ct_start, host_start, count]. > Since neither the container nor the host sides must overlap we can - > again - view these as separate sets of container side [start, count] and > host side [start, count]. > In other words, we can see the entire id map as just 4 sets of [start, > count] ranges which must not overlap. > > So I think all we need to do is sort these by the 'start' value, and for > each element make sure that > > prevous_start + previous_count <= current_start > > And yes, that means we need to sort $id_maps twice, once by ct id, once > by host id, and then iterate and do the above check. > > Should be much shorter (and faster). Yeah, good point, splitting $id_maps into separate uid/gid maps, and then sorting+iterating twice (I'll call this the "sorting algorithm" below) does sound more understandable than the current ad-hoc approach, and faster too. However, one small benefit of iterating over $id_maps in its original order (instead of sorting) is that the error message always references the *first* invalid map entry in the config, e.g. (omitting host uids for clarity) 1) u 1000 <...> 100 2) u 950 <...> 100 3) u 900 <...> 100 4) u 850 <...> 100 The sorting algorithm would error on entry 3, which might suggest to users that entries 1-2 are okay (which they are not). The current algorithm errors on line 2 already. Similar things would happen with interleaved uid/gid mappings, I guess. But I'm not sure if this really matters to users. What do you think?