Is there any namespace (process, user, etc) that isolates environment variables?
In case there is, what happens when you
unshare? Do they get cloned? What happens if a process changes an existing variable?
EDIT: I am using Ubuntu
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It only takes a minute to sign up.Sign up to join this community
You don't need any namespace to isolate environment variables. They're already isolated and private to each process. Modifying an environment variable in a child process will NOT propagate to its parent.
Environment variables in Unix are just a bunch of strings stored in the address space of a process. When a process forks, its children will "inherit" a copy of them together with the whole address space, and when a program executes another (and replaces the entire content of the address space), they have to be passed explicitly as the
envp argument to the
execve(2) system call if they're to be preserved.
If you want to start a process with an empty environment, you can start it as
env - cmd ...
which will just call
execve("/path/to/cmd", ["cmd", ..., NULL], [NULL]).
Or to run it with an environment containing just
env - FOO=bar cmd ...
Both the namespace affecting system calls (
setns(2)) and command line utilities like
unshare(1) do not consider or affect the environment in any special way.
Note: This is how it works in Unix, not some law of nature. On other systems like plan9 (where the concept the namespace originated, but where all namespaces are basically mount namespaces, since everything there is a file/system) the environment is just a filesystem mounted by default on
/env and, contrary to Unix, shared by default between the parent and the child.
Environment variables in
bash are only scoped to a particular instance of the shell, so there is no need to define separate namespaces for them.
You can see this clearly if you open two terminal windows at once (in a Desktop Environment). Create a new environment variable in one of them, e.g.:
It won't appear in the
bash session in the other terminal window.