diff options
authorMichał Górny <>2020-01-08 15:08:06 +0100
committerMichał Górny <>2020-01-08 15:08:06 +0100
commit948bbef11c4b1dd6abe97ad90e71c0a396a9a843 (patch)
tree2c9a34611771ab771a2c48157849d735c7795d9b /user-group.rst
parentAnti-eblit policy (diff)
User/group policy
Signed-off-by: Michał Górny <>
Diffstat (limited to 'user-group.rst')
1 files changed, 55 insertions, 0 deletions
diff --git a/user-group.rst b/user-group.rst
new file mode 100644
index 0000000..389f3b9
--- /dev/null
+++ b/user-group.rst
@@ -0,0 +1,55 @@
+Users and groups
+.. index:: user
+.. index:: group
+User and group account policy
+:Source: QA
+:Reported: by repoman and pkgcheck (as deprecated eclass)
+All new user/group accounts must be created via `GLEP 81`_ packages.
+The existing packages should be migrated on the next version bump or
+major update.
+Existing and historical fixed UIDs/GIDs in range 0..499 (used
+in baselayout or via user.eclass) as listed in uid-gid.txt can be reused
+as-is in acct-* packages.
+UIDs and GIDs in range 0..100 are reserved for important system
+accounts. New assignments in that range need to be explicitly approved
+by the QA lead, in response to a justified request from the developer.
+The range 101..499 is provided for regular use by packages.
+The assignments from this range follow the following rules:
+1. A developer can select an arbitrary free UID/GID from this range.
+ If in doubt, it is recommended to select successive numbers from 499
+ downwards.
+2. Unless there is a very good reason not to, matching users and groups
+ should use the same number. It is acceptable to leave gaps
+ in assignments as a result of that.
+3. Before pushing the new acct-* packages, the developer must push
+ an update to uid-gid.txt adding the 'acct' entry for the desired
+ UID/GID. This serves as a synchronization primitive to prevent
+ collisions.
+Further UID/GID ranges will be open in the future as the need arises.
+*Rationale*: this is the second version of the policy for GLEP 81
+packages. It simplifies the process to aid rapid adoption of the new
+system. Review requirement and pointless cross-distro syncing were
+removed, in favor of a simple process of allocating the next free number
+and using it.
+The ranges have been chosen to delay the imminent collision between
+explicitly reserved UIDs / GIDs and the ones allocated dynamically by
+user.eclass (starting from 999 downwards). The lowest GID range has
+been reserved for true system users and groups.
+.. _GLEP 81: