I would like to run a new process (for example an xterm) in another network namespace. This could be done like this:

sudo ip netns exec otherns sudo -u $USER xterm

This command looks a bit complicated and involves running a sudo which runs ip which runs sudo which runs the final xterm.

Is there a more direct way to run a process in a new namespace?

I was thinking of writing a own small (SUID or capability enabled) binary which switches namespace restores permissions and user and runs the command, but shouldn't there already be some standard tool doing exactly that?

This would allow me to simply call something like:

runns otherns xterm
  • Do you have a kernel 3.8 (necessary for user namespaces)? If so you shouldn't need sudo at all. The basic tool to create a namespace is unshare. – Gilles 'SO- stop being evil' Jun 2 '15 at 23:36
  • My kernel is 4.0.4. Namespaces are available and working. (In this case I am talking about network namespaces not user namespaces.) Both the unshare and the setns system call need the CAP_SYS_ADMIN capability, hence "normal" users are not allowed to switch namespaces. – michas Jun 2 '15 at 23:52

Would the --setuid option of nsenter(1) come to your rescue? Such as in:

sudo nsenter --net=/run/netns/otherns --setuid 1000 --setguid 1000 xterm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.