Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

4
votes
1answer
26 views

Is there a file that associates a thread to its network namespace?

/proc/[pid]/ns/net contains a link to the inode representing the network namespace of the process with PID [pid]. Is there something similar for threads? My use case is a multi-threaded application, ...
1
vote
0answers
12 views

Access usb wireless adapter from network namespace

I have a wireless usb adapter and I would like my docker container to use just this for the internet (not the computers own wireless adapter). I think I can do this if I know how to access the adapter ...
0
votes
1answer
33 views

Route from netns through a veth link

I have created a network namespace (with ip netns add) and a pair of veth links, virt-a and virt-b. The physical link in the root namespace is named eth0. virt-a is in the root namespace and virt-b is ...
0
votes
0answers
26 views

Filesystem permission problems with user namespaces and debootstrap

I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better). I am currently running the following commands to start an ...
1
vote
0answers
43 views

Why do I get permission denied when using unshare?

I'm exploring the namespace feature of linux kernel, using Archlinux. But I got some message that I can't explain the reason, could anyone explain them to me? xtricman⚓ArchVirtual⏺️~🤐export LANG=...
1
vote
1answer
71 views

With Linux user namespaces, why can clone() mount /proc, but unshare() cannot?

I am trying to get a non-root user to mount /proc in a Linux user namespace. If I create a namespace via clone(), then I can mount /proc. However, if I create a namespace via unshare(), then the ...
1
vote
1answer
141 views

Unable to create user namespace in RHEL

I'm trying to create user namespace in RHEL 7 but unable to because of the below error: [root@teja7131 ~]# unshare -U /bin/bash unshare: unshare failed: Invalid argument Please explain the correct ...
2
votes
1answer
543 views

How do you debug inability to delete a Namespace after ip netns add test [closed]

cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer) cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpu,cpuacct) cgroup on /sys/fs/...
3
votes
1answer
119 views

firejail : only let a program access localhost

I have this local network service and this client program needing to access it. I am running them both as an unprivileged user. I am looking for a way to sandbox the client using firejail, in a way ...
1
vote
2answers
75 views

Is it possible for mount(8) to override systemd MountFlags?

I am working on Debian stretch/4.14.75 and have been using my own automounter (udev-hook + shell-script) for years. Since it breaks recently due to the namespace problem that the mounted directory is ...
2
votes
1answer
53 views

What code prevents mount namespace loops? In a more complex case involving mount propagation

Background information The following commands return an error: # touch /tmp/a # mount --bind /proc/self/ns/mnt /tmp/a mount: /tmp/a: wrong fs type, bad option, bad superblock on /proc/self/ns/mnt, ...
2
votes
1answer
50 views

What happens to the mount namespace of an interrupted process

I am experimenting with mount namespaces. I have a python script, which creates a bind mount, after that a mount namespace with the unshare system call. I print the PID, and pause the script. I can ...
0
votes
1answer
46 views

How to Keep Network Namespace after reboot

I have created a network namespace, but after I have reboot, it've been removed. I don't found an answer at this problem on the internet, so this is why I'm asking you : Is there a way to keep a ...
0
votes
1answer
193 views

Namespace management with ip netns (iproute2)

I would like to know where to look up changes applied to custom namespaces. Let's say I have a namespace "ns1" with virtual interfaces "vpeer" and "lo" inside and I would like to modify configurations ...
1
vote
1answer
49 views

Is devtmpfs special with respect to namespaces? a permissions problem

I'm wondering if devtmpfs is special with respect to namespaces. Here's my system info (using Vagrant for testing) vagrant@ubuntu-xenial:~/test$ uname -a Linux ubuntu-xenial 4.4.0-135-generic #161-...
2
votes
1answer
520 views

What is the NSFS filesystem?

The kernel contains a filesystem, nsfs. snapd creates a nsfs mount under /run/snapd/ns/<snapname>.mnt for each installed snap. ls shows it as a 0 byte file. The kernel source code does not seem ...
1
vote
0answers
46 views

Keeping a PID from being reused by mounting /proc/[pid]/ns/pid?

I'm looking for a way to temporarily prevent a process ID from being reused. The man page for NAMESPACES(7) says: Bind mounting (see mount(2)) one of the files in [/proc/[pid]/ns/] to somewhere ...
2
votes
1answer
100 views

Inside a user namespace, why am I not allowed to remount a filesystem I have mounted?

https://github.com/systemd/systemd/issues/9914#issuecomment-416387637 $ uname -r 4.17.18-200.fc28.x86_64 $ unshare -U -r -m # mkdir TMP # mount -t tmpfs tmpfs TMP/ # mount -o remount,ro TMP/ mount: ....
1
vote
1answer
305 views

Understanding how mount namespaces work in Linux

I am reading about mount namespaces and see: in a mount namespace you can mount and unmount filesystems without it affecting the host filesystem. So you can have a totally different set of devices ...
0
votes
1answer
32 views

Could the mount namespace API effectively be made redundant? What obstacles would there be?

You can still access files and directories in a different mount namespace, if you have a reference to them. However, currently you can't manipulate (or even list) the mounts of a mount namespace, if ...
0
votes
1answer
61 views

How to `unshare -n` without changing to root?

I'd like to run a shell that behaves exactly like the parent but without network. Why do I have to su <login> after unshare?
6
votes
1answer
242 views

Losing permissions by adding capability?

I observed the following phenomenon that I can not explain. After adding the CAP_SYS_ADMIN capability, unshare is no longer able to write to /proc/self/setgroups. In fact, writing to this file ...
12
votes
1answer
624 views

Why can't I bind-mount “/” inside a user namespace?

Why doesn't this work? $ unshare -rm mount --bind / /mnt mount: /mnt: wrong fs type, bad option, bad superblock on /, missing codepage or helper program, or other error. These work ok: $ unshare -...
2
votes
1answer
276 views

Switching into a network namespace does not change /sys/class/net?

The Linux man page for network namespaces(7) says: Network namespaces provide isolation of the system resources associated with networking: [...], the /sys/class/net directory, [...]. However, ...
10
votes
1answer
568 views

How to perform chroot with Linux namespaces?

After reading about Linux namespaces I was under the impression that they are, amongst a lot of other features, an alternative to chroot. For example, in this article: Other uses [of namespaces] ...
1
vote
1answer
109 views

I don't understand how entering a mount namespace can work

either if you fork into a new mount namespace, or enter an existing one. It is possible to hold file descriptors from a foreign mount namespace. You can demonstrate this very easily, by finding a ...
1
vote
1answer
95 views

Linux mount namespace hopping considered harmful?

In an application, I need to temporarily "switch" into a specific mount namespace to check some things inside it in /proc, then switch back to the mount namespace my application was started with, then ...
0
votes
0answers
29 views

Linux processes without certain namespaces?

When chromium is running I see processes in /proc/[PID]/ where some of the namespace links inside /proc/[PID]/ns/do link to nothing, that is, they cannot be readlinked and return errors instead. Also ...
2
votes
1answer
388 views

Did the pivot_root() documentation anticipate the feature of mount namespaces?

pivot_root() moves the root filesystem of the calling process to the directory put_old and makes new_root the new root filesystem of the calling process. The typical use of pivot_root(...
5
votes
1answer
205 views

First process in a new Linux user namespace needs to call setuid()?

I'm learning about Linux user namespaces and I'm observing a strange behavior which isn't completely clear to me. I've created a range of UIDs in initial user namespaces to which I can map UIDs in ...
3
votes
2answers
448 views

Separate DNS configuration in each network namespace

I've set up several network namespaces on my Linux system (kernel version 3.10), and now I want to configure each network namespace to have its own DNS settings. I created resolv.conf files in each /...
1
vote
1answer
84 views

Access /proc/pid/ns/net without running query process as root?

In a program I'm enumerating network namespaces by scanning /proc/pid/ for ns/net links. This program runs inside the "root" namespaces (original init) of the host itself. Normally, I need to run the ...
0
votes
1answer
140 views

What rule prevents entering a user namespace from inside a chroot?

# rpm -q --whatprovides /usr/bin/unshare util-linux-2.32-2.fc28.x86_64 # unshare -r # i.e. the above succeeds, where the following does not. What rule causes this? # rpm -q --whatprovides /usr/sbin/...
2
votes
1answer
175 views

How to get pppd to create ppp0 inside namespace?

I have a simple pppoe connection which is working fine. A simple # pon my-isp creates a ppp0 device. I have defined a namespace like ip netns add physical but after ip netns exec physical pon my-...
5
votes
1answer
343 views

unshare --map-root-user switch to original uid/username after setup

I'm using unshare to create per process mounts, which is working perfectly fine by unshare -m --map-root-user However, after having created my bind-mounts by mount --bind src dst I want to change ...
0
votes
0answers
105 views

Modify existing overlay mount

Is it possible to insert additional lower layers to an existing overlayfs mount? The idea is to add new features to a running "chroot" so that they immediately see these changes in their root fs ...
1
vote
1answer
149 views

Configure delay and bandwidth in veth link

I have created 6 namespaces and have attached veth links between them. I'm trying to configure delay and bandwidth to the links, but the following error is shown : Cannot find device "eth0" Cannot ...
0
votes
1answer
494 views

Assign MAC address to a veth pair

I have created 6 namespaces and configured them with veth links. I'm trying to attach MAC address. But the following error is shown : SIOCSIFHWADDR: Cannot assign requested address SIOCSIFHWADDR: ...
0
votes
2answers
35 views

Distinguish the name and namespace

Reference to 'namespace', in Namespace - Wikipedia: In computing, a namespace is a set of symbols that are used to organize objects of various kinds, so that these objects may be referred to by ...
0
votes
0answers
133 views

Creating an exact copy of a whole process?

fork() forks a process, but it will not copy all of its threads; nor will it create a clone of all its fds: the fds are shared between parent and child. I want a way of do a complete fork. So after I ...
4
votes
1answer
412 views

Linux Capabilities with User Namespaces

I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability. ...
0
votes
1answer
98 views

`umount -R` on bind mounts takes a non-neglible amount of time, why?

Why does umount -R take 0.2s to unmount this subtree of bind mounts? It only took 0.02s to mount the subtree, and 0.00s to change its propagation flags. (I was looking at cloning the current set of ...
1
vote
1answer
41 views

cat heredocument copied everything besides function call

I executed the following code in my Bash console in an Ubuntu 16.04 environment: cat <<-'DWA' > /opt/dwa.sh DWA() { test='test' read domain find /var/www/html/ -...
2
votes
0answers
352 views

What is the difference between /etc/group and /etc/subgid?

I am in a Docker context and i am using user namespaces to map my container's user into my host's user (let's say foo). As i use portainer (As a container), i need to bind the Docker socket. $ll /var/...
1
vote
2answers
857 views

Internet connectivity using linux network namespace

I experimenting with Linux namespaces on Ubuntu 17.1 distro. Ultimate goal is to force an application to use a particular network interface via a 3G modem not the intranet wired connection. My PC has ...
2
votes
0answers
225 views

Create network namespace that doesn't use global tunnel (VPN) interface

My understanding of what ip netns does (and general networking) is fuzzy, so maybe what I'm asking for isn't even possible. So, what I have. Three global interfaces, let's call them lo, eth0 and ...
2
votes
2answers
2k views

How to make reachable macvlan aliases in a different namespaces?

I have an interface, name eth0, in my main network namespace another interface, name jail0, in an alternate network namespace (name name0). This namespace is used by a jailed environment. jail0 is a ...
0
votes
1answer
357 views

Why does unshare based killing only work reliably with --fork?

From this answer we have learned that you can implement reliable killing of entire process subtrees with Linux PID namespaces via unshare -p. Here is problem with it that I don't understand: It only ...
1
vote
1answer
201 views

Why do people still use SFTP jails based on SSH chroot rather than namespace capabilities of Systemd? [closed]

The idea might be stupid or not feasible, I don't know, but I can't find any reference about this... As you may know (and as SE definitely knows!), one of the common steps used to tighten SSH ...
1
vote
0answers
35 views

Creating a private tmpfs mount in a shell script

Is there any command that can be utilized in a shell script to create a mount namespace? What it is and how do I use it? Does it get disposed of when the calling script exits?