Skip to content

Conversation

@wenzhuoz
Copy link

Nobody's uid and gid are now 65534:65534 in busybox:

$ docker exec -it 3proxy sh
/ # cat /etc/passwd 
root:x:0:0:root:/root:/bin/sh
daemon:x:1:1:daemon:/usr/sbin:/bin/false
bin:x:2:2:bin:/bin:/bin/false
sys:x:3:3:sys:/dev:/bin/false
sync:x:4:100:sync:/bin:/bin/sync
mail:x:8:8:mail:/var/spool/mail:/bin/false
www-data:x:33:33:www-data:/var/www:/bin/false
operator:x:37:37:Operator:/var:/bin/false
nobody:x:65534:65534:nobody:/home:/bin/false

@wenzhuoz
Copy link
Author

Perhaps a better solution is to enable users to choose uid/gid. I am closing my pull request.

https://wiki.ubuntu.com/nobody:

Some misguided programs or guides suggest that this user should be used for untrusted program execution or handling untrusted data. This is bad advice. Services should have their own, dedicated, user account. Even on sites where NFS is not being used, processes run as user nobody or files owned by user nobody may grant far more privileges than expected, especially if two services have been misconfigured in this fashion.

Do not use the user nobody for anything. It is for NFS.

https://en.wikipedia.org/wiki/User_identifier:

Special values
0: The superuser normally has a UID of zero (0).[10]
−1: The value (uid_t) -1 is reserved by POSIX to identify an omitted argument.[11]
65535: This value is still avoided because it was the API error return value when uid_t was 16 bits.
Nobody: Historically, the user "nobody" was assigned UID -2 by several operating systems, although other values such as 215−1 = 32,767 are also in use, such as by OpenBSD.[12] For compatibility between 16-bit and 32-bit UIDs, many Linux distributions now set it to be 216−2 = 65,534; the Linux kernel defaults to returning this value when a 32-bit UID does not fit into the return value of the 16-bit system calls.[13] Fedora Linux assigns the last UID of the range statically allocated for system use (0–99) to nobody: 99, and calls 65534 instead nfsnobody.

@wenzhuoz wenzhuoz closed this May 11, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant