Questions tagged [namespace]
Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.
290
questions
1
vote
0
answers
18
views
Network namespace stopped working after hardware change
A couple of days ago I had a motherboard failure and as a result I bought a new computer. I swapped in the old hard drives and after a couple of hiccups, everything was nearly the same again. It is ...
- 11
2
votes
0
answers
22
views
Am I right that /proc/PID/status capabilities are always shown in the user namespace of PID?
I always assumed that /proc/[PID]/status shows capabilities that PID has in the user namesapce of the process that opens /proc/[PID]/status, not in the user namespace of PID, but it seems that I was ...
- 21
1
vote
0
answers
18
views
Is it possible to use a veth created in a user namespace as a regular user in a practical way?
This question hints that it is possible to create a veth (which normally requires root) from inside a user and network namespace, and indeed:
user@host$ unshare --user --net -r =bash
root@namespace# ...
- 329
2
votes
1
answer
138
views
What is the reason why creating a veth requires root?
I recently became aware of solutions like slirp4netns or passt/pasta which essentially work around the fact that you can't create a pair of veth network interfaces without root (or CAP_NET_ADMIN). ...
- 329
0
votes
0
answers
47
views
What PrivateUsers= does exactly?
I am having a hard time understanding Manual for PrivateUsers=. It mentions a few caveats for it to fail silently... But I think i'm avoiding them all and still not managing to reach the manual ...
- 488
0
votes
0
answers
18
views
How to "validate" restrictions on a service?
When using features such as RootDirectory= or ProtectSystem=full or ProtectHome= or BindReadOnlyPaths= or ReadOnlyPaths= or PrivateNetwork= or InaccessibleDirectories=, how do you validate them easily?...
- 488
0
votes
0
answers
53
views
Mount in a directory I don't have permissions to for my user only
Is it possible to circumvent the traditional mount permission requirements if I just need my own user to see the mount?
For example, I want to bind mount /home/$USER/folder into /folder. I do not have ...
- 41
0
votes
0
answers
25
views
How is the namespace able to communicate with eth0 without NAT here
I was following this tutorial https://github.com/faysalmehedi/linux-network-namespaces-hands-on
I had to use this command so that our ns1 namespace can talk to eth0, where 192.168.1.1 is the IP ...
- 101
0
votes
1
answer
63
views
Why the access to /proc/[pid]/ns needs to generate symlinks?
The directories of the form /proc/[pid]/ns get populated each time they are accessed. That is, each time they are accessed the kernel produces a symlink to somewhere in the namespace filesystem (not ...
3
votes
0
answers
76
views
Why can't root bypass permissions in an ID-mapped mount?
Why does global root (root in the initial user namespace) not have the ability to read all files regardless of permission when ID-mapped mounts (see "ID-mapped mounts" under man 2 ...
1
vote
1
answer
145
views
Connecting two network namespaces over a bridge
I'm trying to make one network namespace to be able to ping another namespace via a bridge.
Here are the commands I'm executing:
# create two namespaces
ip netns add ns0
ip netns add ns1
# create a ...
- 247
2
votes
0
answers
140
views
Mounting overlayfs in a user namespace with child mounts
I am trying to mount an overlayfs on /tmp from within a separate user & mount namespace. This works well unless /tmp already has a child mount in the original namespace, in which case this ...
0
votes
0
answers
18
views
Virtual interface pair forwarding packets to each other
The goal is very simple: anything sent to pair1, as outgoing packet, should appear on pair0 as an incoming packet and vice versa. I am thinking on a layer3-only, virtual interface now.
tun could do ...
- 9,898
3
votes
1
answer
181
views
Disable namespaces in Linux without compiling
Is there a way to disable all namespace types at boot time or runtime in Linux?
- 4,168
0
votes
0
answers
46
views
How to forward data via netns exec namespace
I'm using zmq to receive data from another pc. I would like to formard this received data to the Internet via namespace. I've created this python script:
import subprocess
import zmq
context = zmq....
0
votes
0
answers
26
views
How to get full mountpoint path name by the sturct fc_context
In my kernel module, I've implemented a syscall hook named fsconfig to manage operations related to remounting readonly mountpoints. For instance, if a user executes mount /dev/sda /tmp/mytest -o ...
- 1
1
vote
1
answer
81
views
Can't use user/group IDs in unshared namespace
When mounting a tmpfs in a mount and user namespace that is separate from my 'regular' system, my expectation is that it's possible to use any user/group ID.
There would be no need for mapping IDs ...
- 35
2
votes
1
answer
64
views
Cannot close LUKS volume while any flatpak app is running
The problem
I cannot cryptsetup close any LUKS volume while any flatpak app is running in the background. Yes, the flatpak app just has to be running in the background, I'm not trying to use ...
- 111
1
vote
0
answers
33
views
Isolating a child process in a remote desktop program
I'm developing a remote desktop/streaming program for linux. When a user logs in, they specify a program to launch, and the remote server launches that program as a new process. The server process ...
- 11
0
votes
1
answer
187
views
Kubernetes Namespace Stuck in 'Terminating'
I'm encountering an issue where a Kubernetes namespace is stuck in the 'Terminating' state. Running kubectl get ns cattle-monitoring-system -o json|jq produces error messages related to custom.metrics....
- 835
1
vote
0
answers
97
views
What is causing permission denied under proot?
At work I have limited access to my PC, so I am running proot with /nix mounted to give me access to nix package manager. However, executing some setuid commands fails under proot.
$ proot /usr/bin/...
- 870
0
votes
0
answers
124
views
How can I mount a 9p filesystem from an unprivileged user namespace?
I'm trying to mount a 9p filesystem from inside a user namespace.
First, I run the 9p server:
p9ufs -v --unix '/run/9p/srved'
I then use the setuid binary 9mount (https://sqweek.net/code/9mount/) to ...
1
vote
0
answers
299
views
What causes `newuidmap` to be dissallowed in new user namespace?
I expected
uid=0(root) gid=0(root) groups=0(root)
to be the output of both
$ rootlesskit id
$ unshare -U bash -c 'newuidmap $$ 0 '"$(id -u)"' 1; id'
however the somewhat more verbose -x ...
- 14.7k
0
votes
0
answers
103
views
systemd kill process and child with SIGTERM
Hi have a very strange scenario when my process (and its child) receives a SIGTERM and the sender is systemd (PID == 1). My setup is the following:
two "simmetric" partitions mounted on /...
- 101
0
votes
1
answer
1k
views
How to Make a Systemd Private Network Namespace Accessable
So I have an application that only binds to 0.0.0.0 and listens on a port (TCP).
The communication is unencrypted and unauthorized so I'd like to work around that without getting too deep into the ...
- 113
0
votes
1
answer
150
views
centos/linux: run tftpd in a non-default net namespace
I wonder if anyone succeeded starting a tftpd in a network namespace (I'm using tftp-server-5.2-22.el7.x86_64.rpm)?
I.e., starting tftpd in a default NS is trivial:
bash# systemctl start tftp
bash# ...
- 83
1
vote
1
answer
324
views
podman running as user dies after hard reboot - Method gave invalid 400 URI Failure message: Failed to setgroups - setgroups (22: Invalid argument)
I'm struggling to determine what is going on here. Podman running in user space was running fine, but the server took a hard reboot and now it is... for lack of a more accurate technical assessment, ...
- 677
0
votes
1
answer
519
views
Cannot create an NVMe shared namespace and attach it to both primary and secondary controllers
I tried creating a namespace on a Samsung PM1735 NVMe SSD then attach it to primary (0x41) and secondary (0x1) controllers, but it's attaching only to the primary controller (I'm running on Ubuntu 20....
- 1
1
vote
0
answers
112
views
How to forward packets between net namespaces?
I have a lima VM with linux running Ubuntu 23.04 with kernel 6.2 and cgroupsv2. This VM is meant to serve as docker host. When I create docker network in this VM I get an interface in its own ...
- 14.4k
2
votes
1
answer
1k
views
Create new process namespace with existing mount namespace
I'm having trouble figuring out how to create a new process namespace once I exit from the one created by unshare. So, for example, I have the following.
unshare -f --mount-proc --mount=/containers/1/...
- 141
2
votes
1
answer
437
views
Root network namespace as transit between 2 other net namespaces
I am trying to communicate between two network namespaces that are connected through the root namespaces using veth pairs as seen in the diagram. I am unable to perform a ping from netns A to netns B. ...
1
vote
0
answers
214
views
How to firewall a network namespace using firewalld?
I'm running fedora 36 using firewalld as my firewall.
I set up a network namespace called "wireguard". It contains the interface wg0 which connects to Mullvad VPN. I set it up like this:
ip ...
3
votes
0
answers
289
views
Use Public IPv4 on Linux Network Namespace
I am using a VPS and gotten an extra IP address. I am trying and failing to assign the second IP address to a separate network namespace.
Lets say my main IP and netmask is x.x.133.39/23 and my ...
- 31
0
votes
1
answer
526
views
systemd service timeout when using sudo
Target
I am trying to run a service (transmission-daemon) in a network namespace for VPN usage. The service should automatically start using systemd.
Implementation details
I am using namespaced-...
- 1
2
votes
1
answer
449
views
Unable to get a namespace to access the external network
I am running Linux in a VirtualBox environment. I have successfully defined 2 namespaces connected via a bridge that can talk to each other. I want to be able to get UDP packets out onto the actual ...
- 121
1
vote
0
answers
349
views
Explanation of details in SOURCE column of findmnt
I have some questions regarding the output of the "findmnt" command, specifically the SOURCE column:
TARGET SOURCE FSTYPE ...
- 11
0
votes
0
answers
203
views
Forward traffic from public IP to namespace
I have two VMs VM-A & VM-B connected via IPIP Tunnel in a namespace. I want the application in VM-B which is under namespace to be accessed from the public IP of VM-C. Can someone help me how can ...
- 378
4
votes
1
answer
1k
views
What mechanism prevents me from reading /proc/<PID>/environ in containers with a PID namespace shared with the host?
While investigating sharing the PID namespace with containers, I noticed something interesting that I don't understand. When a container shares the PID namespace with the host, some processes have ...
- 141
0
votes
1
answer
173
views
Fix Polyinstantiation of /tmp causing 'connect /tmp/.X11-unix/X0: No such file or directory'
In a multiseat desktop system with the /tmp directory polyinstantiated, the /tmp/.X11-unix/ directory and Xn instances are still created under root's /tmp not a user's.
ssh -Ying into or out of the ...
- 554
1
vote
1
answer
1k
views
Why is my namespace not detected?
I tried form home,then sudo su -
ip netns exec 5bd337503b01 ip addr show
Cannot open network namespace "5bd337503b01": No such file or directory
pwd shows
/var/run/docker/netns
Why?
- 319
0
votes
0
answers
37
views
Why is the default NameSpace of pid always 4026531836 [duplicate]
Why is the default NameSpace of pid always 4026531836.
Whats special about this number?
- 215
4
votes
1
answer
1k
views
How do you get the child pid of `unshare` when using --fork for `nsenter -t <pid>`?
When using unshare --pid --fork, the nsenter command must attach to the child pid not the unshare pid to get to the right pid namespace.
I can get unshare's pid as follows:
unshare --pid --mount --...
- 505
2
votes
2
answers
772
views
Why is the Linux command `unshare --pid=p --mount=m` not creating a persistent namespace?
From everything I have read in the unshare and nsenter man pages, I should be able to bind-mount a directory to itself, mount --make-private the directory, and then use files within that directory to ...
- 505
1
vote
1
answer
273
views
If ports are unpriviledged, why can't I access them if I am root in a namespace?
I've run sudo sysctl -w net.ipv4.ip_unprivileged_port_start=1. However, sudo ip netns exec myvpn unshare -r python -m http.server -b 127.0.0.1 2 does not work. Strangely enough, this does: sudo ip ...
8
votes
1
answer
1k
views
How does /proc interact with PID namespaces?
I do not understand how namespaces interact with /proc. I assumed that /proc returns values based on the process that queries them.
For example, let's determine the PID of the current process inside ...
- 258
0
votes
1
answer
474
views
How to login to a user namespace created by unshare?
How to login to a user namespace created by unshare -U from another terminal?
- 299
-1
votes
1
answer
327
views
Dockers create user namespaces?
My question is about how Docker instrument the storage for the container instance.
Do container applications or Docker create user namespaces when creating a new container instance?
- 299
-2
votes
1
answer
797
views
How to create a user namespace in Ubuntu?
I want to create namespaces with and without the privilege and need to study the implications if the namespace creation is restricted only for the privileged users.
How to create a user namespace in ...
- 299
0
votes
0
answers
189
views
How to expand the number of subuids for a linux namespace
After running something like this:
$ unshare -rUm
$ mkdir opt
$ mount --bind opt /opt
$ touch /opt/test
$ chown 1000:1000 /opt/test
I'm receiving this:
chown: changing ownership of '/opt/test': ...
- 1
2
votes
0
answers
114
views
How to mount folders on a per-process basis while keeping all functionalities of regular shell
In order to fake a FHS OS on a non-FHS OS (NixOs) and to increase "purity", I need to mount some folders and overlay other folders in a per-process basis, for instance /lib does not exists ...
- 4,361