I'm trying to create user namespace in RHEL 7 but unable to because of the below error:
[root@teja7131 ~]# unshare -U /bin/bash unshare: unshare failed: Invalid argument
Please explain the correct argument format for creating the user namespace.
If one uses
strace to inspect the command
$ strace -o logf -f unshare -U sh unshare: unshare failed: Invalid argument $ grep 'Invalid argument' logf 31728 unshare(CLONE_NEWUSER) = -1 EINVAL (Invalid argument) 31728 write(2, "Invalid argument\n", 17) = 17
this reveals that the system call
unshare(2) has failed. Notably
CLONE_NEWUSER does not appear in the manual page, which could be a documentation bug or could indicate that
CLONE_NEWUSER is not supported on a stock install of RedHat 7 (I'm using Centos7 here on a test system, which is similar to but different from RedHat 7).
$ man 2 unshare | col -b | grep CLONE_NEWUSER $
This is strange; altagoobingleduckgoing the terms
CLONE_NEWUSER yields questions about
unshare(CLONE_NEWUSER) though from that
CONFIG_USER_NS is apparently enabled on Centos 7:
$ grep CONFIG_USER_NS /boot/config-$(uname -r) CONFIG_USER_NS=y
Yet more altagoobingleduckgoing turns up an lxc thread that indicates that "Currently user namespaces are in TECH PREVIEW phase" (as of RedHat 7.2) so may or may not work. Adding
user_namespace.enable=1 to the kernel arguments did not help on my Centos 7.5 system (and is not necessary in testing, below). The Kernel features page however lists user namespaces as supported; Filipe Brandenburger found is it safe to enable user namespaces which indicates that by default RedHat 7 enables 0 namespaces for users, though this number can be increased:
# cat /proc/sys/user/max_user_namespaces 0 # echo 640 > /proc/sys/user/max_user_namespaces # unshare -U sh sh-4.2$
max_user_namespaces on Centos 7.5 works, and does not require the
user_namespace.enable=1 kernel flag.
Even more reading: