First of all, I know about virtualisation and containers. I'm sure "he wants containers" is what popped in your mind. (Don't deny it!)

However containers are like chroot: if you want to execute bash in it, you need to copy/mirror a bash executable somewhere in the container FS as well as all the required libs. (If I misunderstood something, please correct me).

What I want to know is whether I can start a program like busybox from the current namespace (using the original FS, so no copy needed) and then isolate it (for instance using Linux FS namespace) to let it access one unique directory.

Somehow ssh (sftp actually) seems to be able to do something like this without requiring the sshd executable to be in the chrooted FS. But I still lack skills to understand what's going on by myself.

  • what about the chroot(2) system call ? (not the chroot(8) command) – Jasen Nov 21 '15 at 9:57
  • Chroot (as a whole) has been created as way to change the system root, not as a security feature. That means that I have to check for a dozen of holes and add some constrains to be able to use it correctly. But I agree, a chroot-like function created only for isolation would be great! – LouisTP Nov 23 '15 at 1:55

I think you're probably looking for containers.

Or perhaps not. Linux namespaces can be pretty transparent, after all. I don't believe there is a way to unshare a namespace for a process which has already been called, but you definitely can unshare a namespace at call time with little to no effect.

cd   /tmp
echo you >hey
sudo unshare -m busybox
echo hey >you; cat  hey


...and from another terminal...

cd   /tmp
cat  you


...the mount tree is shared by default from the parent namespace, and, though busybox's mount propagation flags are all set to private by default, it makes no difference until a change to the mount tree is somehow effected in the namespace. This need not be done through busybox, either.

...in busybox's terminal...

echo "#$$"


...and now from the other...

sudo nsenter -t8854 -m mount -t tmpfs none /tmp
cd .; cat hey


...but from busybox's terminal, and therefore from the namespace we just effected a mount...

cd .;  cat hey

cat: hey: no such file or directory

...because a new private tmpfs was mounted over the shared /tmp in the nsenter command...

cd ..
umount tmp
cat tmp/hey

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.