See the License for the specific language governing permissions and
limitations under the License.
*/

package pidlimit

import (
	"k8s.io/api/core/v1"
)

const (
	// PIDs is the (internal) name for this resource
	PIDs v1.ResourceName = "pid"

now support a `MayRunAs` rule for `fsGroup` and `supplementalGroups` options. This allows specifying ranges of allowed GIDs for pods/containers without forcing a default GID the way `MustRunAs` does. This means that a container to which such a policy applies to won't use any fsGroup/supplementalGroup GID if not explicitly specified, yet a specified GID must still fall in the GID range according to the policy. ([#65135](https://github.com/kubernetes/kubernetes/pull/65135), [@stlaz](https://github.com/stlaz))...

    SID[] sids;

    public MsrpcLookupSids(LsaPolicyHandle policyHandle, SID[] sids) {
        super(policyHandle,
                new LsarSidArrayX(sids),
                new lsarpc.LsarRefDomainList(),
                new lsarpc.LsarTransNameArray(),
                (short)1,
                sids.length);
        this.sids = sids;
        ptype = 0;

		t.Fatalf("Expected 3 keys, got %d", len(jk.Keys))
	}

	var kids []string
	for ii, jks := range jk.Keys {
		_, err := jks.DecodePublicKey()
		if err != nil {
			t.Fatalf("Failed to decode key %d: %v", ii, err)
		}
		kids = append(kids, jks.Kid)
	}
	if len(kids) != 3 {
		t.Fatalf("Failed to find the expected number of kids: 3, got %d", len(kids))
	}
}

// A.1 - Example public keys

	for i, err := range errs {
		if err != nil {
			t.Errorf("Failed adding first round of UIDs for job %s: %v", tracks[i].job, err)
		}
	}

	for _, track := range tracks {
		uids := expectations.getSet(track.job)
		if uids == nil {
			t.Errorf("Set of UIDs is empty for job %s", track.job)
		} else if diff := cmp.Diff(track.firstRound, sets.List(uids.set)); diff != "" {
			t.Errorf("Unexpected keys for job %s (-want,+got):\n%s", track.job, diff)

iptables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
ip6tables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 1 -j CT --zone 1
iptables -t raw -D ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
ip6tables -t raw -D ISTIO_OUTPUT -p udp --sport 15053 -m owner --gid-owner 1 -j CT --zone 2
iptables -t raw -D ISTIO_OUTPUT -p udp --dport 53 -m owner --gid-owner 2 -j CT --zone 1

specific language governing permissions and limitations
under the License.
-->

<project>
    <modelVersion>4.0.0</modelVersion>
    <artifactId>aid</artifactId>
    <groupId>gid</groupId>
    <version>0.1</version>
    <packaging>pom</packaging>

    <profiles>
        <profile>
            <id>+invalid-id</id>
        </profile>
        <profile>
            <id>-invalid-id</id>

iptables -t nat -A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -m owner --gid-owner 1 -j RETURN
iptables -t nat -A ISTIO_OUTPUT -o lo ! -d 127.0.0.1/32 -p tcp ! --dport 15008 -m owner --gid-owner 2 -j ISTIO_IN_REDIRECT
iptables -t nat -A ISTIO_OUTPUT -o lo -m owner ! --gid-owner 2 -j RETURN

     * @throws IOException
     */
    public void resolve ( String authorityServerName, CIFSContext tc ) throws IOException {
        SID[] sids = new SID[1];
        sids[ 0 ] = this;
        tc.getSIDResolver().resolveSids(tc, authorityServerName, sids);
    }


    void resolveWeak () {
        if ( this.origin_server != null ) {
            try {

@SuppressWarnings ( "javadoc" )
public class MsrpcGetMembersInAlias extends samr.SamrGetMembersInAlias {

    public MsrpcGetMembersInAlias ( SamrAliasHandle aliasHandle, lsarpc.LsarSidArray sids ) {
        super(aliasHandle, sids);
        this.sids = sids;
        this.ptype = 0;
        this.flags = DCERPC_FIRST_FRAG | DCERPC_LAST_FRAG;
    }