'\" t .\" Title: usermod .\" Author: Julianne Frances Haugh .\" Generator: DocBook XSL Stylesheets vsnapshot .\" Date: 30/07/2026 .\" Manual: System Management Commands .\" Source: shadow-utils 4.20.0 .\" Language: French .\" .TH "USERMOD" "8" "30/07/2026" "shadow\-utils 4\&.20\&.0" "System Management Commands" .\" ----------------------------------------------------------------- .\" * Define some portability stuff .\" ----------------------------------------------------------------- .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .\" http://bugs.debian.org/507673 .\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html .\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" ----------------------------------------------------------------- .\" * set default formatting .\" ----------------------------------------------------------------- .\" disable hyphenation .nh .\" disable justification (adjust text to left margin only) .ad l .\" ----------------------------------------------------------------- .\" * MAIN CONTENT STARTS HERE * .\" ----------------------------------------------------------------- .SH "NOM" usermod \- Modifier un compte utilisateur .SH "SYNOPSIS" .HP \w'\fBusermod\fR\ 'u \fBusermod\fR [\fIoptions\fR] \fILOGIN\fR .SH "DESCRIPTION" .PP The \fBusermod\fR command modifies the system account files\&. .SH "OPTIONS" .PP The options which apply to the \fBusermod\fR command are: .PP \fB\-a\fR, \fB\-\-append\fR .RS 4 Add the user to the supplementary group(s)\&. Use only with the \fB\-G\fR option\&. .RE .PP \fB\-b\fR, \fB\-\-badname\fR .RS 4 Allow names that do not conform to standards\&. .RE .PP \fB\-c\fR, \fB\-\-comment\fR\ \&\fICOMMENT\fR .RS 4 update the comment field of the user in /etc/passwd, which is normally modified using the \fBchfn\fR(1) utility\&. .RE .PP \fB\-d\fR, \fB\-\-home\fR\ \&\fIHOME_DIR\fR .RS 4 Le nouveau r\('epertoire personnel de l\*(Aqutilisateur\&. .sp If the \fB\-m\fR option is given, the contents of the current home directory will be moved to the new home directory, which is created if it does not already exist\&. If the current home directory does not exist the new home directory will not be created\&. .RE .PP \fB\-e\fR, \fB\-\-expiredate\fR\ \&\fIEXPIRE_DATE\fR .RS 4 Specifies the date on which the user account will be disabled\&. The value can be specified as a date in the YYYY\-MM\-DD format or as a number of days since 1970\-01\-01\&. The date is interpreted using the UTC timezone\&. .sp An input of \-1 or an empty string blanks the account expiration field in the shadow password file\&. The account will remain available with no expiration date\&. .sp This option requires the /etc/shadow file\&. If no entry exists in the /etc/shadow file, the system will automatically create one\&. .RE .PP \fB\-f\fR, \fB\-\-inactive\fR\ \&\fIINACTIVE\fR .RS 4 Defines the number of days after a password exceeds its maximum age during which the user can still log in by immediately changing their password\&. If the user does not change their password within this period of time, their account becomes inactive\&. This value is stored in the shadow password file\&. .sp A value of 0 disables the account when the password expires, with no delay\&. .sp A value of \-1 empties the respective field in the shadow password file, which means that the inactivity period is not enforced\&. .sp This option requires the /etc/shadow file\&. If no entry exist in the /etc/shadow file, the system will automatically create one\&. .RE .PP \fB\-g\fR, \fB\-\-gid\fR\ \&\fIGROUP\fR .RS 4 The name or numerical ID of the user\*(Aqs new primary group\&. The group must exist\&. .sp Tout fichier du r\('epertoire personnel de l\*(Aqutilisateur appartenant au groupe primaire pr\('ec\('edent de l\*(Aqutilisateur appartiendra \(`a ce nouveau groupe\&. .sp Le groupe propri\('etaire des fichiers en dehors du r\('epertoire personnel de l\*(Aqutilisateur doit \(^etre modifi\('e manuellement\&. .sp The change of the group ownership of files inside of the user\*(Aqs home directory is also not done if the home dir owner uid is different from the current or new user id\&. This is a safety measure for special home directories such as /\&. .RE .PP \fB\-G\fR, \fB\-\-groups\fR\ \&\fIGROUP1\fR[\fI,GROUP2,\&.\&.\&.\fR[\fI,GROUPN\fR]]] .RS 4 A list of supplementary groups which the user is also a member of\&. Each group is separated from the next by a comma, with no intervening whitespace\&. The groups must exist\&. .sp If the user is currently a member of a group which is not listed, the user will be removed from the group\&. This behaviour can be changed via the \fB\-a\fR option, which appends the user to the current supplementary group list\&. .RE .PP \fB\-l\fR, \fB\-\-login\fR\ \&\fINEW_LOGIN\fR .RS 4 The name of the user will be changed from \fILOGIN\fR to \fINEW_LOGIN\fR\&. Nothing else is changed\&. In particular, the user\*(Aqs home directory or mail spool should probably be renamed manually to reflect the new login name\&. .RE .PP \fB\-L\fR, \fB\-\-lock\fR .RS 4 Lock a user\*(Aqs password\&. This puts a \*(Aq!\*(Aq in front of the encrypted password, effectively disabling the password\&. You can\*(Aqt use this option with \fB\-p\fR or \fB\-U\fR\&. .sp Note: if you wish to lock the account (not only access with a password), you should also set the \fIEXPIRE_DATE\fR to \fI1\fR\&. .RE .PP \fB\-m\fR, \fB\-\-move\-home\fR .RS 4 moves the content of the user\*(Aqs home directory to the new location\&. If the current home directory does not exist the new home directory will not be created\&. .sp This option is only valid in combination with the \fB\-d\fR (or \fB\-\-home\fR) option\&. .sp \fBusermod\fR will try to adapt the ownership of the files and to copy the modes, ACL and extended attributes, but manual changes might be needed afterwards\&. .RE .PP \fB\-o\fR, \fB\-\-non\-unique\fR .RS 4 allows to change the user ID to a non\-unique value\&. .sp This option is only valid in combination with the \fB\-u\fR option\&. As a user identity serves as key to map between users on one hand and permissions, file ownerships and other aspects that determine the system\*(Aqs behavior on the other hand, more than one login name will access the account of the given UID\&. .RE .PP \fB\-p\fR, \fB\-\-password\fR\ \&\fIPASSWORD\fR .RS 4 defines a new password for the user\&. PASSWORD is expected to be encrypted, as returned by \fBcrypt \fR(3)\&. .sp \fBNote:\fR Avoid this option on the command line because the password (or encrypted password) will be visible by users listing the processes\&. .sp The password will be written in the local /etc/passwd or /etc/shadow file\&. This might differ from the password database configured in your PAM configuration\&. .sp Il est n\('ecessaire de v\('erifier si le mot de passe respecte la politique de mots de passe du syst\(`eme\&. .RE .PP \fB\-r\fR, \fB\-\-remove\fR .RS 4 Remove the user from named supplementary group(s)\&. Use only with the \fB\-G\fR option\&. .RE .PP \fB\-R\fR, \fB\-\-root\fR\ \&\fICHROOT_DIR\fR .RS 4 Apply changes in the \fICHROOT_DIR\fR directory and use the configuration files from the \fICHROOT_DIR\fR directory\&. Only absolute paths are supported\&. No SELINUX support\&. .RE .PP \fB\-P\fR, \fB\-\-prefix\fR\ \&\fIPREFIX_DIR\fR .RS 4 Apply changes within the directory tree starting with \fIPREFIX_DIR\fR and use as well the configuration files located there\&. This option does not chroot and is intended for preparing a cross\-compilation target\&. Some limitations: NIS and LDAP users/groups are not verified\&. PAM authentication is using the host files\&. No SELINUX support\&. .RE .PP \fB\-s\fR, \fB\-\-shell\fR\ \&\fISHELL\fR .RS 4 changes the user\*(Aqs login shell\&. An empty string for SHELL empties the field in /etc/passwd and logs the user into the system\*(Aqs default shell\&. .RE .PP \fB\-u\fR, \fB\-\-uid\fR\ \&\fIUID\fR .RS 4 The new value of the user\*(Aqs ID\&. .sp This value must be unique, unless the \fB\-o\fR option is used\&. The value must be non\-negative\&. .sp La bo\(^ite aux lettres et tous les fichiers poss\('ed\('es par l\*(Aqutilisateur et qui sont situ\('es dans son r\('epertoire personnel verront leur identifiant d\*(Aqutilisateur automatiquement modifi\('e\&. .sp Le propri\('etaire des fichiers en dehors du r\('epertoire personnel de l\*(Aqutilisateur doit \(^etre modifi\('e manuellement\&. .sp The change of the user ownership of files inside of the user\*(Aqs home directory is also not done if the home dir owner uid is different from the current or new user id\&. This is a safety measure for special home directories such as /\&. .sp No checks will be performed with regard to the \fBUID_MIN\fR, \fBUID_MAX\fR, \fBSYS_UID_MIN\fR, or \fBSYS_UID_MAX\fR from /etc/login\&.defs\&. .RE .PP \fB\-U\fR, \fB\-\-unlock\fR .RS 4 Unlock a user\*(Aqs password\&. This removes the \*(Aq!\*(Aq in front of the encrypted password\&. You can\*(Aqt use this option with \fB\-p\fR or \fB\-L\fR\&. .sp Note: if you wish to unlock the account (not only access with a password), you should also set the \fIEXPIRE_DATE\fR (for example to \fI99999\fR, or to the \fBEXPIRE\fR value from /etc/default/useradd)\&. .RE .PP \fB\-v\fR, \fB\-\-add\-subuids\fR\ \&\fIFIRST\fR\-\fILAST\fR .RS 4 Ajoute une plage d\*(AqUIDs subalternes au compte de l\*(Aqutilisateur\&. .sp This option may be specified multiple times to add multiple ranges to a user\*(Aqs account\&. .sp No checks will be performed with regard to \fBSUB_UID_MIN\fR, \fBSUB_UID_MAX\fR, or \fBSUB_UID_COUNT\fR from /etc/login\&.defs\&. .RE .PP \fB\-V\fR, \fB\-\-del\-subuids\fR\ \&\fIFIRST\fR\-\fILAST\fR .RS 4 Supprime une plage d\*(AqUids subalternes du compte de l\*(Aqutilisateur\&. .sp This option may be specified multiple times to remove multiple ranges to a user\*(Aqs account\&. When both \fB\-\-del\-subuids\fR and \fB\-\-add\-subuids\fR are specified, the removal of all subordinate uid ranges happens before any subordinate uid range is added\&. .sp No checks will be performed with regard to \fBSUB_UID_MIN\fR, \fBSUB_UID_MAX\fR, or \fBSUB_UID_COUNT\fR from /etc/login\&.defs\&. .RE .PP \fB\-w\fR, \fB\-\-add\-subgids\fR\ \&\fIFIRST\fR\-\fILAST\fR .RS 4 Ajoute une plage de gids subalternes au compte d\*(Aqun utilisateur\&. .sp This option may be specified multiple times to add multiple ranges to a user\*(Aqs account\&. .sp No checks will be performed with regard to \fBSUB_GID_MIN\fR, \fBSUB_GID_MAX\fR, or \fBSUB_GID_COUNT\fR from /etc/login\&.defs\&. .RE .PP \fB\-W\fR, \fB\-\-del\-subgids\fR\ \&\fIFIRST\fR\-\fILAST\fR .RS 4 Supprime une plage de gids subalternes du compte de l\*(Aqutilisateur\&. .sp This option may be specified multiple times to remove multiple ranges to a user\*(Aqs account\&. When both \fB\-\-del\-subgids\fR and \fB\-\-add\-subgids\fR are specified, the removal of all subordinate gid ranges happens before any subordinate gid range is added\&. .sp No checks will be performed with regard to \fBSUB_GID_MIN\fR, \fBSUB_GID_MAX\fR, or \fBSUB_GID_COUNT\fR from /etc/login\&.defs\&. .RE .PP \fB\-S\fR, \fB\-\-add\-subids\fR .RS 4 Add subordinate uids and gids to the user\*(Aqs account\&. .sp An appropriate uid and gid range is automatically selected from /etc/login\&.defs defaults\&. .RE .PP \fB\-Z\fR, \fB\-\-selinux\-user\fR\ \&\fISEUSER\fR .RS 4 defines the SELinux user to be mapped with \fILOGIN\fR\&. An empty string ("") will remove the respective entry (if any)\&. Note that the shadow system doesn\*(Aqt store the selinux\-user, it uses semanage(8) for that\&. .RE .PP \fB\-\-selinux\-range\fR\ \&\fISERANGE\fR .RS 4 defines the SELinux MLS range for the new account\&. Note that the shadow system doesn\*(Aqt store the selinux\-range, it uses \fBsemanage\fR(8) for that\&. .sp This option is only valid if the \fB\-Z\fR (or \fB\-\-selinux\-user\fR) option is specified\&. .RE .SH "AVERTISSEMENTS" .PP You must make certain that the named user is not executing any processes when this command is being executed if the user\*(Aqs numerical user ID, the user\*(Aqs name, or the user\*(Aqs home directory is being changed\&. \fBusermod\fR checks this on Linux\&. On other operating systems it only uses utmp to check if the user is logged in\&. .PP You must change the owner of any \fBcrontab\fR files or \fBat\fR jobs manually\&. .PP Les modifications qui concernent NIS doivent \(^etre effectu\('ees sur le serveur NIS\&. .SH "CONFIGURATION" .PP The following configuration variables in /etc/login\&.defs change the behavior of this tool: .PP \fBLASTLOG_UID_MAX\fR (number) .RS 4 Highest user ID number for which the lastlog entries should be updated\&. As higher user IDs are usually tracked by remote user identity and authentication services there is no need to create a huge sparse lastlog file for them\&. .sp No \fBLASTLOG_UID_MAX\fR option present in the configuration means that there is no user ID limit for writing lastlog entries\&. .RE .PP \fBMAIL_DIR\fR (string) .RS 4 The mail spool directory\&. This is needed to manipulate the mailbox when its corresponding user account is modified or deleted\&. If not specified, a compile\-time default is used\&. The parameter CREATE_MAIL_SPOOL in /etc/default/useradd determines whether the mail spool should be created\&. .RE .PP \fBMAIL_FILE\fR (string) .RS 4 D\('efinir l\*(Aqemplacement des bo\(^ites aux lettres des utilisateurs relativement \(`a leur r\('epertoire personnel\&. .RE .PP The \fBMAIL_DIR\fR and \fBMAIL_FILE\fR variables are used by \fBuseradd\fR, \fBusermod\fR, and \fBuserdel\fR to create, move, or delete the user\*(Aqs mail spool\&. .PP \fBMAX_MEMBERS_PER_GROUP\fR (number) .RS 4 Maximum members per group entry\&. When the maximum is reached, a new group entry (line) is started in /etc/group (with the same name, same password, and same GID)\&. .sp La valeur par d\('efaut est 0, ce qui signifie qu\*(Aqil n\*(Aqy a pas de limites pour le nombre de membres dans un groupe\&. .sp Cette fonctionnalit\('e (groupe d\('ecoup\('e) permet de limiter la longueur des lignes dans le fichier de groupes\&. Ceci est utile pour s\*(Aqassurer que les lignes pour les groupes NIS ne sont pas plus grandes que 1024 caract\(`eres\&. .sp Si vous avez besoin de configurer cette limite, vous pouvez utiliser 25\&. .sp Remarque\ \&: les groupes d\('ecoup\('es ne sont peut\-\(^etre pas pris en charge par tous les outils (m\(^eme dans la suite d\*(Aqoutils Shadow)\&. Vous ne devriez pas utiliser cette variable, sauf si vous en avez vraiment besoin\&. .RE .PP \fBSUB_GID_MIN\fR (number), \fBSUB_GID_MAX\fR (number), \fBSUB_GID_COUNT\fR (number) .RS 4 If /etc/subuid exists, the commands \fBuseradd\fR and \fBnewusers\fR (unless the user already have subordinate group IDs) allocate \fBSUB_GID_COUNT\fR unused group IDs from the range \fBSUB_GID_MIN\fR to \fBSUB_GID_MAX\fR for each new user\&. .sp The default values for \fBSUB_GID_MIN\fR, \fBSUB_GID_MAX\fR, \fBSUB_GID_COUNT\fR are respectively 100000, 600100000 and 65536\&. .RE .PP \fBSUB_GID_DETERMINISTIC\fR (boolean) .RS 4 If set to \fIyes\fR, the commands \fBuseradd\fR, \fBusermod\fR, and \fBnewusers\fR will calculate subordinate GID ranges deterministically based on the user\*(Aqs UID instead of searching for the next free range\&. The formula used is: .sp .if n \{\ .RS 4 .\} .nf start = SUB_GID_MIN + ((UID \- UID_MIN) * SUB_GID_COUNT) end = start + SUB_GID_COUNT \- 1 .fi .if n \{\ .RE .\} .sp This ensures the same UID always receives the same subordinate GID range on every system, making it suitable for environments with centralized user management (LDAP, NIS, etc\&.) or synchronized UIDs across systems\&. .sp If \fBSUB_GID_DETERMINISTIC\fR is enabled, you can use \fBusermod \-\-add\-subgids \-S\fR to produce deterministic subgids\&. .sp \fBWARNING\fR: Because \fBUID_MIN\fR is used to calculate the ranges, any change of \fBUID_MIN\fR will change the ranges calculated\&. \fBSUB_GID_COUNT\fR is used to calculate the ranges, any change of \fBSUB_GID_COUNT\fR will change the ranges calculated\&. Users with identities less than \fBUID_MIN\fR are incompatible with \fBSUB_GID_DETERMINISTIC\fR, but can still be set manually\&. .sp \fBWARNING\fR: Do not mix deterministic and linear (default) allocation on the same system or across systems sharing /etc/subgid via network storage (NFS, etc\&.)\&. Mixing allocation methods \fB will cause subordinate ID range conflicts and overlaps \fR\&. .sp The default value for \fBSUB_GID_DETERMINISTIC\fR is \fIno\fR\&. .SS "Range Calculation Examples" With default configuration (\fBUID_MIN\fR=1000, \fBSUB_GID_MIN\fR=100000, \fBSUB_GID_COUNT\fR=65536): .TS allbox tab(:); lB lB lB. T{ UID T}:T{ Calculation T}:T{ Subordinate GID Range T} .T& l l l l l l l l l l l l. T{ 1000 T}:T{ 100000 + ((1000\-1000) * 65536) T}:T{ 100000\-165535 T} T{ 1001 T}:T{ 100000 + ((1001\-1000) * 65536) T}:T{ 165536\-231071 T} T{ 1002 T}:T{ 100000 + ((1002\-1000) * 65536) T}:T{ 231072\-296607 T} T{ 1100 T}:T{ 100000 + ((1100\-1000) * 65536) T}:T{ 6653600\-6719135 T} .TE .sp 1 .SS "Subordinate ID Space Planning" When planning subordinate ID allocation, calculate the maximum number of users the space can accommodate: .sp .if n \{\ .RS 4 .\} .nf capacity = (SUB_GID_MAX \- SUB_GID_MIN) / SUB_GID_COUNT .fi .if n \{\ .RE .\} .sp With default values: (600100000 \- 100000) / 65536 ≈ 9155 users\&. .sp For high\-density environments with many users and smaller allocations: .sp .if n \{\ .RS 4 .\} .nf SUB_GID_COUNT 4096 SUB_GID_MIN 100000 SUB_GID_MAX 10000000 .fi .if n \{\ .RE .\} .sp This gives: (10000000 \- 100000) / 4096 ≈ 2417 users\&. .RE .PP \fBUNSAFE_SUB_GID_DETERMINISTIC_WRAP\fR (boolean) .RS 4 \fB WARNING: SECURITY RISK \- MAY CAUSE RANGE OVERLAPS AND PRIVILEGE ESCALATION! \fR .sp Only effective when \fBSUB_GID_DETERMINISTIC\fR is set to \fIyes\fR\&. .sp When set to \fIyes\fR (WRAP MODE), allows the deterministic range calculation to wrap around using modulo arithmetic when a UID would overflow the configured subordinate ID space\&. The subordinate ID space is treated as a ring buffer\&. .sp \fBWARNING\fR: Range overlaps can lead to container escapes and privilege escalation\&. For example, with \fBSUB_GID_MIN\fR=100000, \fBSUB_GID_MAX\fR=200000, \fBSUB_GID_COUNT\fR=65536, User A (UID 1000) gets range [100000, 165535] and User B (UID 1001) wraps and overlaps with User A\&. User B\*(Aqs container can now access files from User A\*(Aqs containers\&. .sp Use \fBonly\fR in development, testing, or tightly constrained lab environments\&. .sp When set to \fIno\fR (default), any arithmetic overflow or range exceeding \fBSUB_GID_MAX\fR is a hard error\&. This guarantees non\-overlapping, monotonic allocation\&. .sp The default value for \fBUNSAFE_SUB_GID_DETERMINISTIC_WRAP\fR is \fIno\fR\&. .RE .PP \fBSUB_UID_MIN\fR (number), \fBSUB_UID_MAX\fR (number), \fBSUB_UID_COUNT\fR (number) .RS 4 If /etc/subuid exists, the commands \fBuseradd\fR and \fBnewusers\fR (unless the user already have subordinate user IDs) allocate \fBSUB_UID_COUNT\fR unused user IDs from the range \fBSUB_UID_MIN\fR to \fBSUB_UID_MAX\fR for each new user\&. .sp The default values for \fBSUB_UID_MIN\fR, \fBSUB_UID_MAX\fR, \fBSUB_UID_COUNT\fR are respectively 100000, 600100000 and 65536\&. .RE .PP \fBSUB_UID_DETERMINISTIC\fR (boolean) .RS 4 If set to \fIyes\fR, the commands \fBuseradd\fR, \fBusermod\fR, and \fBnewusers\fR will calculate subordinate UID ranges deterministically based on the user\*(Aqs UID instead of searching for the next free range\&. The formula used is: .sp .if n \{\ .RS 4 .\} .nf start = SUB_UID_MIN + ((UID \- UID_MIN) * SUB_UID_COUNT) end = start + SUB_UID_COUNT \- 1 .fi .if n \{\ .RE .\} .sp This ensures the same UID always receives the same subordinate UID range on every system, making it suitable for environments with centralized user management (LDAP, NIS, etc\&.) or synchronized UIDs across systems\&. .sp If \fBSUB_UID_DETERMINISTIC\fR is enabled, you can use \fBusermod \-\-add\-subuids \-S\fR to produce deterministic subuids\&. .sp \fBWARNING\fR: Because \fBUID_MIN\fR is used to calculate the ranges, any change of \fBUID_MIN\fR will change the ranges calculated\&. \fBSUB_UID_COUNT\fR is used to calculate the ranges, any change of \fBSUB_UID_COUNT\fR will change the ranges calculated\&. Users with identities less than \fBUID_MIN\fR are incompatible with \fBSUB_UID_DETERMINISTIC\fR, but can still be set manually\&. .sp \fBWARNING\fR: Do not mix deterministic and linear (default) allocation on the same system or across systems sharing /etc/subuid via network storage (NFS, etc\&.)\&. Mixing allocation methods \fB will cause subordinate ID range conflicts and overlaps \fR\&. .sp The default value for \fBSUB_UID_DETERMINISTIC\fR is \fIno\fR\&. .SS "Range Calculation Examples" With default configuration (\fBUID_MIN\fR=1000, \fBSUB_UID_MIN\fR=100000, \fBSUB_UID_COUNT\fR=65536): .TS allbox tab(:); lB lB lB. T{ UID T}:T{ Calculation T}:T{ Subordinate UID Range T} .T& l l l l l l l l l l l l. T{ 1000 T}:T{ 100000 + ((1000\-1000) * 65536) T}:T{ 100000\-165535 T} T{ 1001 T}:T{ 100000 + ((1001\-1000) * 65536) T}:T{ 165536\-231071 T} T{ 1002 T}:T{ 100000 + ((1002\-1000) * 65536) T}:T{ 231072\-296607 T} T{ 1100 T}:T{ 100000 + ((1100\-1000) * 65536) T}:T{ 6653600\-6719135 T} .TE .sp 1 .SS "Subordinate ID Space Planning" When planning subordinate ID allocation, calculate the maximum number of users the space can accommodate: .sp .if n \{\ .RS 4 .\} .nf capacity = (SUB_UID_MAX \- SUB_UID_MIN) / SUB_UID_COUNT .fi .if n \{\ .RE .\} .sp With default values: (600100000 \- 100000) / 65536 ≈ 9155 users\&. .sp For high\-density environments with many users and smaller allocations: .sp .if n \{\ .RS 4 .\} .nf SUB_UID_COUNT 4096 SUB_UID_MIN 100000 SUB_UID_MAX 10000000 .fi .if n \{\ .RE .\} .sp This gives: (10000000 \- 100000) / 4096 ≈ 2417 users\&. .RE .PP \fBUNSAFE_SUB_UID_DETERMINISTIC_WRAP\fR (boolean) .RS 4 \fB WARNING: SECURITY RISK \- MAY CAUSE RANGE OVERLAPS AND PRIVILEGE ESCALATION! \fR .sp Only effective when \fBSUB_UID_DETERMINISTIC\fR is set to \fIyes\fR\&. .sp When set to \fIyes\fR (WRAP MODE), allows the deterministic range calculation to wrap around using modulo arithmetic when a UID would overflow the configured subordinate ID space\&. The subordinate ID space is treated as a ring buffer\&. .sp \fBWARNING\fR: Range overlaps can lead to container escapes and privilege escalation\&. For example, with \fBSUB_UID_MIN\fR=100000, \fBSUB_UID_MAX\fR=200000, \fBSUB_UID_COUNT\fR=65536, User A (UID 1000) gets range [100000, 165535] and User B (UID 1001) wraps and overlaps with User A\&. User B\*(Aqs container can now access files from User A\*(Aqs containers\&. .sp Use \fBonly\fR in development, testing, or tightly constrained lab environments\&. .sp When set to \fIno\fR (default), any arithmetic overflow or range exceeding \fBSUB_UID_MAX\fR is a hard error\&. This guarantees non\-overlapping, monotonic allocation\&. .sp The default value for \fBUNSAFE_SUB_UID_DETERMINISTIC_WRAP\fR is \fIno\fR\&. .RE .SH "FICHIERS" .PP /etc/group .RS 4 Group account information .RE .PP /etc/gshadow .RS 4 Secure group account information .RE .PP /etc/login\&.defs .RS 4 Shadow password suite configuration .RE .PP /etc/passwd .RS 4 User account information .RE .PP /etc/shadow .RS 4 Secure user account information .RE .PP /etc/subgid .RS 4 Per user subordinate group IDs .RE .PP /etc/subuid .RS 4 Per user subordinate user IDs .RE .SH "VOIR AUSSI" .PP \fBchfn\fR(1), \fBchsh\fR(1), \fBpasswd\fR(1), \fBcrypt\fR(3), \fBgpasswd\fR(8), \fBgroupadd\fR(8), \fBgroupdel\fR(8), \fBgroupmod\fR(8), \fBlogin.defs\fR(5), \fBsubgid\fR(5), \fBsubuid\fR(5), \fBuseradd\fR(8), \fBuserdel\fR(8)\&.