My Linux kernel must have been configured with user_namespaces when built, but their use is restricted after boot and has to be explicitly enabled. Which sysctl should I use?

(If this was turned on, this would allow to run an isolation command like unshare --user --map-root-user --mount-proc --pid --fork, and then perform chroot without being root--a much anticipated feature of Linux.)


Debian (and hence probably Ubuntu, too) has been known to ship a kernel with such a restriction of user_namespaces, and there the way to enable it was/is:

sysctl -w kernel.unprivileged_userns_clone=1

(Source: https://blog.mister-muffin.de/2015/10/25/unshare-without-superuser-privileges/.)

ALT has such a restriction in kernel-image-std-def, too. Differently from Debian, it's called kernel.userns_restrict.

Normally, it is 1 (i.e., "restricted"):

$ cat /proc/sys/kernel/userns_restrict 

To enable this, echo 0 > /proc/sys/kernel/userns_restrict (or use sysctl as above, of course).

| improve this answer | |
  • 8
    Or, for a permanent solution: echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/userns.conf – josch Jun 10 '18 at 8:32
  • I'd say echo 1 > /proc/sys/kernel/userns_restrict to enable ?! – tisc0 Nov 9 '19 at 23:30
  • @tisc0 No, the sense is opposite in Debian and ALT. In Debian it's 1 to enable the unpriviledged use of it; in ALT, it's 0 not to restrict its use. – imz -- Ivan Zakharyaschev Nov 10 '19 at 1:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.