nsenter are userland tools to work with linux namespaces. Since I, as much as possible, try to avoid working with root priveledges enabled, I often run into troubles with those tools
unshare yielding me some "permissions denied".
I would firstly like to know how I can nevertheless make those tools usable for non-root users?
Also I would then secondly be told what risks or problems (in terms of security) I might phase making namespaces usable for non-root users?
My current partial knowledge related to this question, is that with the introduction of the user namespace kernel feature it would be possible for a non-root user to firstly create a new user namespace in which that user would be root and therefore to nestedly create the user namespaces subsequently from within that user namespace.
It would be helpful if an answer to this question would present and discuss other ways to enable the use of namespaces (i.e. network, ipc, mount, pid, ... etc.) for a non-root user, that is without using the user namespace (which currently might not be enable in all linux distribution). I imagine that a proxy setuid'ed program, might allow to use namespaces for non-roots while not being prone to leak priveledges? Maybe it is even something achievable in the famous
sudo tools via editing
One reason I would like to be able to employ namespaces for a non-root user is that I could without risk of race-codition keepd track of child and descendant processes, given they'd be unruly and double fork or else
setgpid() out of the process tree. This is to say, while I'm interested in the general case how to employ savely linux namespaces as a non-root user I would also appreciate any hint even if it only enabled to use the pid namespace.