My Linux kernel must have been configured with user_namespaces when built, but their use is restricted after boot and has to be explicitly enabled. Which sysctl should I use?

(If this was turned on, this would allow to run an isolation command like unshare --user --map-root-user --mount-proc --pid --fork, and then perform chroot without being root--a much anticipated feature of Linux.)


1 Answer 1


Debian-based Linux

Debian (and hence probably Ubuntu, too) has been known to ship a kernel with such a restriction of user_namespaces, and there the way to enable it was/is:

sysctl -w kernel.unprivileged_userns_clone=1

(Source: https://blog.mister-muffin.de/2015/10/25/unshare-without-superuser-privileges/.)

Since kernel 5.10 (Debian 11/bullseye), Debian enables unprivileged user namespaces by default; if you find they're still disabled, also check the sysctl user.max_user_namespaces (which, unlike kernel.unprivileged_userns_clone, is not Debian-specific).

ALT-Linux Specific

ALT has such a restriction in kernel-image-std-def, too. Differently from Debian, it's called kernel.userns_restrict.

Normally, it is 1 (i.e., "restricted"):

$ cat /proc/sys/kernel/userns_restrict 

To enable this, echo 0 > /proc/sys/kernel/userns_restrict (or use sysctl as above, of course).

  • 8
    Or, for a permanent solution: echo 'kernel.unprivileged_userns_clone=1' > /etc/sysctl.d/userns.conf
    – josch
    Jun 10, 2018 at 8:32
  • I'd say echo 1 > /proc/sys/kernel/userns_restrict to enable ?!
    – tisc0
    Nov 9, 2019 at 23:30
  • @tisc0 No, the sense is opposite in Debian and ALT. In Debian it's 1 to enable the unpriviledged use of it; in ALT, it's 0 not to restrict its use. Nov 10, 2019 at 1:02
  • 1
    Why not just use the same name and default it to true, ie kernel.unprivileged_userns_clone=1 Aug 1, 2020 at 19:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .