The tag has no usage guidance, but it has a tag wiki.

learn more… | top users | synonyms

2
votes
1answer
25 views

Compute total CPU usage of a PID namespace

I'd like to monitor the CPU usage for all processes in a particular PID namespace. I'd like to do it programmatically (C, if possible). I have an idea of how to do it, but I'd like to know if Linux ...
3
votes
2answers
49 views

Is it possible to mount a device in a process' namespace after unshare()

Say I have a process with an isolated MOUNT namespace pid 1200 the process called unshare() to isolate its namespace from the parent process. I then want to mount a device only accessible outside pid ...
1
vote
1answer
30 views

Is it possible to run 'unshare -n [program]' as an unprivileged user?

I want to run a program without any internet access, e.g. unshare -n ping 127.0.0.1. As an unprivileged user, it returns Operation not permitted, as a privileged user, it returns the desired ...
1
vote
0answers
20 views

mount namespace not work in ubuntu whether 15.04 or 14.04

NOTE: Referencing this Q&A: Why is my bind mount visible outside its mount namespace? It gave an unshare example, but it did not work in Ubuntu. I tried on Ubuntu 15.04, with util-linux 2.25. I ...
5
votes
2answers
86 views

Why is my bind mount visible outside its mount namespace?

So I'm trying to get a handle on how Linux's mount namespace works. So, I did a little experiment and opened up two terminals and ran the following: Terminal 1 root@goliath:~# mkdir a b ...
2
votes
1answer
50 views

Is there a way to isolate a running program from the rest of a Linux system?

First of all, I know about virtualisation and containers. I'm sure "he wants containers" is what popped in your mind. (Don't deny it!) However containers are like chroot: if you want to execute bash ...
1
vote
1answer
73 views

SSH: shell opened in IP namespace

I'm trying to force users logging in through SSH to have a shell inside IP namespace. I've tried replacing the shell in /etc/passwd with something like ip netns exec sshns /bin/bash but it didn't ...
5
votes
1answer
68 views

PID in arch-chroot is incorrect

I am trying to run a python script in a chroot (specifically, the chroot is created with arch-chroot). The python script relies on os.getpid(), but this seems to be returning an incorrect PID within ...
1
vote
0answers
18 views

Is an unprivileged LXC where the host user itself is mapped to 0 less secure of one where one of its subids is mapped to 0, and why?

Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped ...
1
vote
1answer
106 views

What characters are valid to use in filenames? [duplicate]

I seems like it is possible to create filenames in unix with just about any valid character. touch \; && touch \\ && touch \" && touch $'\n' && touch $'\t' && ...
1
vote
0answers
74 views

Unmount Recursively Bind Mont in User and Mount Namespace

I am trying to use recursive bind mount in a new user namespace and mount namespace. This is what I do. Assume /foo/bar/ and /foo are both mount points. Firstly I do mount --rbind /foo/bar/ /baz, and ...
1
vote
1answer
92 views

Allow a single process to access a file

If I am the owner of a file, then is there a way I can give another process (running under another user that doesn't have read/write permission to that file) permission to access it? I want only that ...
3
votes
0answers
66 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
2
votes
0answers
51 views

What happens if the last process in a namespace exits?

I am running Linux. I have a single process in a mount namespace. I did in this process a mount -t tmpfs tmpfs /mountpoint. What happens if the process exits and there are no more processes in ...
1
vote
0answers
26 views

Is it allowed to assign one range of subordinate IDs to two different users?

Is it allowed to assign the same range of subordinate user and group IDs to different users on the system defining the subordinate IDs? Please provide sources for your answer. The idea here would ...
1
vote
0answers
84 views

running a process in another namespace

I would like to run a new process (for example an xterm) in another network namespace. This could be done like this: sudo ip netns exec otherns sudo -u $USER xterm This command looks a bit ...
1
vote
1answer
81 views

Using a VPN for certain applications via a network namespace

I am trying to use a network namespace for VPN-specific traffic, using this guide: https://schnouki.net/posts/2014/12/12/openvpn-for-a-single-application-on-linux/ on Debian. Everything works with ...
1
vote
0answers
42 views

icmp limited in many network spaces?

I wrote small script do show example usage of ip netns on unused class size C (here changed into 192.168.10) #!/bin/sh network=192.168.10 for id in `seq 0 127`; do ip netns del test-$id; done; ...
2
votes
1answer
81 views

Re-enter PID 1 namespace

I'm trying to enter PID namespace that process with PID 1 is in from a process cloned with CLONE_NEWPID. I keep getting Invalid argument error. In other words, I clone a child process with clone() ...
6
votes
1answer
2k views

What's a UTS namespace?

The man page of unshare says: UTS namespace setting hostname, domainname will not affect rest of the system (CLONE_NEWUTS flag) What does UTS stand for?
2
votes
1answer
330 views

Is Traffic control inside namespace on ports created by OpenvSwitch supported?

I am trying to limit the bandwidth of an interface inside a namespace using tc without much success. Seems it's not supported according to ...
5
votes
1answer
256 views

View/manipulate mount namespaces in Linux

Is there any way to view or manipulate the mount namespace for an arbitrary process? For example, a docker container is running which has a local mount to an NFS server. It can be seen from inside ...
1
vote
0answers
198 views

Running HTTP process as a sole child in PID/NET namespace

First time posting here so I appreciate your help and patience. After reading about namespaces, looking on various forums including this thread and trial and error I'm still looking for answers for a ...
1
vote
1answer
118 views

How to map IP by iptables ?

I create a network namespace In this namespace, I open a nginx So for now, I can visit web server by 172.17.0.2 What I want to do is mapping this IP to 127.0.0.1 Lets say if I visit 127.0.0.1, I ...
2
votes
3answers
1k views

linux namespace, How to connect internet in network namespace?

I want to test linux network namespace. The current problem is I cannot connect internet in the namespace here is my commands: 1 Create network namespace netns1, create a pair of veths (A and B) ...
3
votes
1answer
2k views

per process private file system mount points

I was checking unshare command and according to it's man page, unshare - run program with some namespaces unshared from parent I also see there is a type of namespace listed as, mount ...
1
vote
0answers
315 views

How to start a process chain from the shell

Is it possible and if so how do I: Start a /bin/bash process that is not bound to a terminal from a terminal? Hence, a shell process that shows up in the process tree as init -- bash. (Shells ...
0
votes
3answers
911 views

Is reparenting from the shell possible?

This question is closely related to How to "correctly" start an application from a shell but tries to tackle a more specific problem. How can I spawn an application from a shell and thereby ...
2
votes
0answers
546 views

Network connectivity issue between different hosts from a network namespace in one host

I have created two Ubuntu 12.04 VMs using VMWare Player with NAT network configuration. I am able to ping them from each other. After that, I created a network namespace in one of them and add a ...
5
votes
1answer
2k views

LXC container to use “virtual” interface from host (namespace semantics)

So according to the documentation on the Ubuntu LXC documentation the following statement can be found at the time of this writing: A NIC can only exist in one namespace at a time, so a physical ...
3
votes
1answer
327 views

Set environment inside `nsenter /bin/bash`

I'm entering a namespace with nsenter -m -u -i -n -p -t $PID /bin/bash. However, printenv inside this namespace doesn't have everything I need. I'd like to send these variables in, but I'd like to ...
9
votes
1answer
1k views

Reliable way to jail child processes using `nsenter:`

I know that Linux namespaces, among many other things, can be leveraged to handle restricting and jailing child processes securely without any chance of their being zombied and dumped on init. But I'm ...
0
votes
1answer
369 views

Linux PID namespaces

I have a question about number of PIDs a process has in context of Linux PID namespaces. Suppose: (NS = namespace) P1 (PID NS1) -> clone -> P2 (PID NS2) -> clone -> P3 (PID NS3) How many PIDs does ...
2
votes
1answer
618 views

How to move process from one namespace to other?

This question is similar to my question about how to list namespaces. So in addtition, I'd like to know some information about moving processes from one namespace to other? E.g. I have processes of ...
11
votes
2answers
3k views

how to find out namespace of a particular process?

I already asked a question about how to list all namespaces in Linux, but there wasn't any correct and exact answers, so I want to find out a method which can help me to find out the namespace of PID ...
6
votes
1answer
2k views

Creating VLANs between network namespaces

I want to implement the topology shown in the figure below using network namespaces (ns1 to ns4). ...
3
votes
2answers
1k views

In a UID namespace, can I setuid to an unmapped UID?

Suppose I'm user ID 1000. I run a program inside a UID namespace, mapping UID 0 inside the namespace to UID 1000 outside the namespace. The program then attempts to change its own UID to 50, which ...
4
votes
1answer
751 views

Is there a command to switch to into an existing namespace?

I am using multiple UTS namespaces, each of them has some servers constantly running. I can get the namespace IDs via readlink /proc/<pid>/ns/uts, now I would like to change into a given ...
8
votes
1answer
2k views

How to list namespaces in Linux?

Is there any method in Linux to list all namespaces on the running host? I need to check namespaces for particular processes (e.g. processes running in LXC-container and all other processes on the ...
3
votes
1answer
3k views

How to assign an additional IP/hostname to a chrooted environment?

While I can simply have e.g. sshd in a chroot environment ("chrootenv") listen to a different port than its parent ("parentenv"), it would be more convenient to have that environment have an ...
7
votes
4answers
205 views

Clean way to temporarily replace a config file?

I use a drawing program called Inkscape, which has both a GUI and a command line interface. When used on the command line, it has a large number of options that can only be controlled through a ...
3
votes
1answer
242 views

A process, run as root, when performing mount, is mounting for `self`, how to make the mount global?

I'm mounting a share from within process'es context. That, ultimately, mounts the object on a per-process namespace basis, rendering it invisible for the rest of the system. The problem is partially ...
14
votes
2answers
1k views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
13
votes
3answers
2k views

kernel: Namespaces support

I am wondering what exactly the “Namespaces support” feature in the Linux kernel means. I am using kernel 3.11.1 (the newest stable kernel at this time). If I decide to disable it, will I notice any ...
1
vote
1answer
66 views

Lightweight userspace sandboxing of filesystem

I would like to trick a non-malicious process to think that it is writing to directory $HOME/abc/def/ while it writes in fact to $HOME/xyz/def (the former path is hardcoded and it does not work for my ...