User namespaces or short `userns` is a facility that allows a sub-namespace to have its own set of UIDs and GIDs. This allows to use the least privilege principle for LXC containers, but it's not limited to that use case.

learn more… | top users | synonyms

1
vote
0answers
18 views

Mounting Overlayfs in a user namespace

Is it possible to mount an Overlayfs filesystem as an unprivileged user in a user namespace in Linux kernels >4.3.3; it seems that the fix to this vulnerability has blocked this functionality entirely....
1
vote
0answers
62 views

Weird behaviour of unprivileged LXC container

Can someone please explain this weird behaviour to me: I have an unpriviliged LXC container with firefox inside. If firefox is running on the host outside of the container, /usr/bin/firefox inside ...
2
votes
0answers
55 views

I have trouble analysing the cause of this (firefox) segfault

When executed within a minimal (unprivileged) LXC container, firefox segfaults (other graphical applications work fine). I'am unable to find the exact cause of this segfault (which is most likely due ...
2
votes
0answers
29 views

How to map a UID to another UID (!= 0) inside a user namespace?

How can one map UID 1000 to another regular UID (not root/0) inside a user namespace? EDIT: For anyone interested, https://linuxcontainers.org/lxc/manpages/man5/lxc.container.conf.5.html lists an ...
3
votes
1answer
66 views

Why can't a UID 0 process hardlink to SUID files in a user namespace?

Consider the following transcript of a user-namespaced shell running with root privileges (UID 0 within the namespace, unprivileged outside): # cat /proc/$$/status | grep CapEff CapEff: ...
1
vote
0answers
34 views

Is it allowed to assign one range of subordinate IDs to two different users?

Is it allowed to assign the same range of subordinate user and group IDs to different users on the system defining the subordinate IDs? Please provide sources for your answer. The idea here would ...
0
votes
1answer
57 views

How can I list all connections to my host, including those to LXC guests?

I tried both netstat and lsof, but it appears it's not possible to see the connections to my LXC guests. Is there a way to achieve this ... for all guests at once? Essentially what throws me off ...
1
vote
1answer
395 views

Can't connect to the sshd in my unprivileged LXC guest. What to do?

So you configured your unprivileged LXC guest, by defining lxc.id_map = u 0 1000000000 10000 lxc.id_map = g 0 1000000000 10000 and of course assigning those subordinate UID/GID ranges to an ...
2
votes
0answers
95 views

Is it possible to register “virtual” user/group IDs in a Linux system?

Is there a standardized mechanism in Linux which can be used to tie usernames to user IDs without actually creating a system account that can log in? It would seem something like this is possible, ...
14
votes
1answer
3k views

What is an unprivileged LXC container?

What does it mean if a Linux container (LXC container) is called "unprivileged"?
8
votes
1answer
4k views

userns container fails to start, how to track down the reason?

When creating a userns (unprivileged) LXC container on Ubuntu 14.04 with the following command line: lxc-create -n test1 -t download -- -d $(lsb_release -si|tr 'A-Z' 'a-z') -r $(lsb_release -sc) -a $(...
3
votes
1answer
179 views

How to influence the assignment of subordinate UIDs/GIDs when creating user accounts?

To my knowledge the subordinate UIDs and GIDs are assigned to accounts in such a manner that they form a contiguous range. The range starts at 100000 by default and probably stretches to the ...
5
votes
1answer
269 views

Subordinate GIDs/UIDs with LXC and userns for unprivileged user?

When using userns (via LXC in my case), you assign a range of subordinate GIDs and UIDs to an unprivileged user. See for resources: subuid(5), subgid(5), newuidmap(1), newgidmap(1), user_namespaces(7)....
1
vote
1answer
102 views

How do I conserve the userns UID/GID mappings when archiving an LXC guest?

I'd like to archive an existing LXC container that has been configured to run as unprivileged LXC container (see this question). How can I conserve all the file system meta-data that is used to store ...
5
votes
1answer
774 views

Migrate an unprivileged LXC container between users

I have an Ubuntu 14.04 server installation which acts as an LXC host. It has two users: user1 and user2. user1 owns an unprivileged LXC container, which uses a directory (inside /home/user1/.local/......
12
votes
1answer
2k views

Is there a tool(!) to list assigned subuid and subgid values for users?

The question is basically in the title. usermod -v (--add-sub-uids) and usermod -w (--add-sub-gids) can be used to manipulate the subuid and subgid ranges for a user account, but there appears to be ...
5
votes
2answers
4k views

Building unprivileged (userns) LXC container from scratch, by migrating a privileged container to be unprivileged

How can I build a privileged LXC (1.0.3) container (that part I know) and then migrate it successfully to be run unprivileged? That is, I'd like to debootstrap it myself or adjust the lxc-ubuntu ...