0

If I create a uts namespace using unshare and set the hostname to foo,

$ unshare --map-root-user --uts /bin/sh
# echo $$
31882
# readlink /proc/31882/ns/uts
uts:[4026532825]
# hostname foo

How can I then use that user-namespace inside of rootless podman without running sudo, for example this does not work and returns "Error: cannot find specified UTS namespace path: stat [proc-ns-link]: permission denied"

$ podman run -ti --uts=ns:/proc/31882/ns/uts alpine:3 /bin/hostname
Error: cannot find specified UTS namespace path: stat /proc/31882/ns/uts: permission denied

But this does work,

$ sudo podman run -ti --uts=ns:/proc/31882/ns/uts alpine:3 /bin/hostname
foo

1 Answer 1

1

I am not familiar with podman but if someone needs to enter into another namespace using /proc/31882/ns/uts then he has to use setns syscall.

In order to reassociate itself with a new network, IPC, time, or UTS namespace, the caller must have the CAP_SYS_ADMIN capability both in its own user namespace and in the user namespace that owns the target namespace. refer: https://man7.org/linux/man-pages/man2/setns.2.html

so, without CAP_SYS_ADMIN (sudo) capabilities, a caller cannot enter into another namespace. If that is possible then that is a security issue.

Additional-note: setting suid bit to podman binary will allow running podman with CAP_SYS_ADMIN capabilities without mentioning sudo but I hope you are not expecting this answer.

2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .