I would like to launch a Docker container which runs a process which may or may not clone itself.
Is it possible to set up a user with normal + clone_newuts permission so that I do not have a login user to my container which is a superuser?
Initially this question was labelled:
CLONE_NEWUTS permission only, which is incorrect. @sourcejedi has answed in good faith below and improved my understanding considerably.
I've found where the su flags are held:
/usr/include/linux/sched.h, I expect the answer to be something along the lines of monkey patching a specific users permissions on container create. I'm going to go along that route for now and see where it takes me.
I found where the user/file capabilities can be set. I see I have a lot of reading to do but I think that a specific permission (capability) can be given to a file (which will be excutable in this case). From the capabilities manpage:
Starting with kernel 2.2, Linux divides the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled and disabled. Capabilities are a per-thread attribute.
so, it should be possible to apply a specific capability (whose flag is found in the above header) to either a file or user. Which one, I'm not sure yet but it's getting pretty fun and deep to find this out.
As @sourcejedi has pointed out I have misinterpreted my needs. The information neccessary is in
man limits.conf, in which one may run a process at a specified user level, in this case
Unfortunately the route I have taken from EDIT-3 is also incorrect. This allows a specified user to run all processes at the specified uesr level. @sourcejedi is still correct, however I will open a new question asking what I really need. Link: Run a single process that can fork and clone as a non-root-user