1

I'm trying to create user namespace in RHEL 7 but unable to because of the below error:

[root@teja7131 ~]# unshare -U /bin/bash
unshare: unshare failed: Invalid argument

Please explain the correct argument format for creating the user namespace.

  • "Invalid argument" here almost certainly does not refer to the command line you entered, but rather, an argument that the command you're invoking is passing to the kernel for the unshare system call. Check dmesg for a possible clue. This might also be distribution-specific, so perhaps vendor-provided resources would be a better avenue of research. – Vladimir Panteleev Nov 3 '18 at 20:33
1

If one uses strace to inspect the command

$ strace -o logf -f unshare -U sh
unshare: unshare failed: Invalid argument
$ grep 'Invalid argument' logf
31728 unshare(CLONE_NEWUSER)            = -1 EINVAL (Invalid argument)
31728 write(2, "Invalid argument\n", 17) = 17

this reveals that the system call unshare(2) has failed. Notably CLONE_NEWUSER does not appear in the manual page, which could be a documentation bug or could indicate that CLONE_NEWUSER is not supported on a stock install of RedHat 7 (I'm using Centos7 here on a test system, which is similar to but different from RedHat 7).

$ man 2 unshare | col -b | grep CLONE_NEWUSER
$ 

This is strange; altagoobingleduckgoing the terms unshare and CLONE_NEWUSER yields questions about unshare(CLONE_NEWUSER) though from that CONFIG_USER_NS is apparently enabled on Centos 7:

$ grep CONFIG_USER_NS /boot/config-$(uname -r)
CONFIG_USER_NS=y

Yet more altagoobingleduckgoing turns up an lxc thread that indicates that "Currently user namespaces are in TECH PREVIEW phase" (as of RedHat 7.2) so may or may not work. Adding user_namespace.enable=1 to the kernel arguments did not help on my Centos 7.5 system (and is not necessary in testing, below). The Kernel features page however lists user namespaces as supported; Filipe Brandenburger found is it safe to enable user namespaces which indicates that by default RedHat 7 enables 0 namespaces for users, though this number can be increased:

# cat /proc/sys/user/max_user_namespaces
0
# echo 640 > /proc/sys/user/max_user_namespaces
# unshare -U sh
sh-4.2$ 

So increasing max_user_namespaces on Centos 7.5 works, and does not require the user_namespace.enable=1 kernel flag.

Even more reading:

https://rhelblog.redhat.com/2015/07/07/whats-next-for-containers-user-namespaces/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.