Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

62 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
8
votes
0answers
378 views

How can I make a device available inside a systemd-nspawn container with user namespacing?

I would like to mount an encrypted image file using cryptsetup inside a systemd-nspawn container. However, I get this error message: [root@container ~]# echo $key | cryptsetup -d - open luks.img luks ...
7
votes
0answers
509 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
6
votes
0answers
1k views

Persistent network namespace configuration

When creating a namespace with ip netns add <namespace> the namespace and it's related config is deleted on reboot along with created interfaces like veth pairs. What is the correct way to: ...
5
votes
0answers
159 views

Opening /proc/<pid>/net/dev prevents network namespace from expiring, is this expected?

I'm looking for input whether the following observation related to network namespace expiration is expected, or should be reported as bug? When some process opens /proc/<pid>/net/dev it can ...
5
votes
1answer
1k views

unshare --map-root-user switch to original uid/username after setup

I'm using unshare to create per process mounts, which is working perfectly fine by unshare -m --map-root-user However, after having created my bind-mounts by mount --bind src dst I want to change ...
5
votes
1answer
388 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
4
votes
0answers
84 views

When does Linux “garbage-collect” namespaces?

My current understanding of Linux (kernel) namespaces is that their lifetime after creation is as long as at least one of the following conditions holds true: at least one process/thread is joined (...
4
votes
0answers
449 views

Why does `systemd-nspawn -n` network namespace not show in `ip netns list`?

tl;dr Linux has namespaces, in particular, network namespaces. It seems the namespace supposedly created via the -n flag when running systemd-nspwawn does not show up when employing ip netns list (...
4
votes
1answer
608 views

why is CAP_SYS_ADMIN needed for CLONE_NEWPID?

man 2 unshare tells us Use of CLONE_NEWPID requires the CAP_SYS_ADMIN capability and the suggested reading for further information man 7 pid_namespaces does not really discuss the presumable risk ...
3
votes
0answers
163 views

I can ping across namespaces, but not connect with TCP

I'm trying to set up two network namespaces to communicate with eachother. I've set up two namespaces, ns0 and ns1 that each have a veth pair, where the non-namespaced side of the veth is linked to a ...
3
votes
0answers
179 views

How to mount files as specific user when using docker namespace remapping?

Problem description: I have a webservice using docker to run nginx and haproxy (among other containers). I want to provide these docker images via a private docker hub registry, and thus don't want ...
3
votes
1answer
265 views

Why can I not bind a mount namespace to a file

I observe the following: As unprivileged user in shell No 1: user@box:~$ sysctl kernel.unprivileged_userns_clone kernel.unprivileged_userns_clone = 1 user@box:~$ unshare --mount --user nobody@box:~$ ...
3
votes
0answers
68 views

Is linux mount propagation asynchronous to the mount call?

I have two processes in different mount namespaces. They have a shared directory bind mounted to /mnt/share. The "master" uses MS_SHARED propagation for the mount, while the "slave" uses MS_SLAVE. ...
3
votes
1answer
1k views

What is the difference between /etc/group and /etc/subgid?

I am in a Docker context and i am using user namespaces to map my container's user into my host's user (let's say foo). As i use portainer (As a container), i need to bind the Docker socket. $ll /var/...
3
votes
1answer
118 views

On a gateway server, can netNS limit a proc to only see the internal nets?

I may be using the wrong tool, but network namespaces seemed like a near ideal fit. I have 3 programs that don't have the ability to specify an listening interface or address (that only listen on "...
3
votes
1answer
2k views

running a process in another namespace

I would like to run a new process (for example an xterm) in another network namespace. This could be done like this: sudo ip netns exec otherns sudo -u $USER xterm This command looks a bit ...
3
votes
0answers
985 views

Network connectivity issue between different hosts from a network namespace in one host

I have created two Ubuntu 12.04 VMs using VMWare Player with NAT network configuration. I am able to ping them from each other. After that, I created a network namespace in one of them and add a ...
2
votes
0answers
25 views

Is there a standard namespace for local definitions of multi-key characters in the ~/.XCompose file?

I want to add some personal definitions to my ~/.XCompose file, but I don't want them to conflict with any official definitions (especially those that appear in the future and aren't defined yet). Is ...
2
votes
0answers
594 views

Docker mapped port doesn't show up on “netstat”, “ss” and “lsof”

I've a question about docker containers and sockets. Today i've discovered that, docker containers with mapped port -p 80:80 (or etc ports) on the host system, doesn't show up when i use netstat, ss ...
2
votes
0answers
304 views

Restrictions on pivot_root to switch root filesystem

This question is a follow up to the question I asked on how LXC setups up its root mount point. For a container named testcontainer, LXC uses bind mount to mount /var/lib/lxc/testcontainer/rootfs to /...
2
votes
0answers
36 views

Create a route to an existing namespace

I have a namespace with an existing interface in it: 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 link/loopback 00:...
2
votes
0answers
93 views

Keeping a PID from being reused by mounting /proc/[pid]/ns/pid?

I'm looking for a way to temporarily prevent a process ID from being reused. The man page for NAMESPACES(7) says: Bind mounting (see mount(2)) one of the files in [/proc/[pid]/ns/] to somewhere ...
2
votes
1answer
542 views

How to get pppd to create ppp0 inside namespace?

I have a simple pppoe connection which is working fine. A simple # pon my-isp creates a ppp0 device. I have defined a namespace like ip netns add physical but after ip netns exec physical pon my-...
2
votes
0answers
388 views

Create network namespace that doesn't use global tunnel (VPN) interface

My understanding of what ip netns does (and general networking) is fuzzy, so maybe what I'm asking for isn't even possible. So, what I have. Three global interfaces, let's call them lo, eth0 and ...
2
votes
0answers
122 views

Dissable pid-namespace init process signal handler restriction

Ubuntu 16.04 / Linux version 4.4.0-47-generic / gcc version 5.4.0 I want to implement a container using linux cgroups and part of the implementation was to run the process into a new pid-namespace. ...
2
votes
0answers
1k views

What are the ways and risks of using linux namespaces as nonroot user?

I know unshare and nsenter are userland tools to work with linux namespaces. Since I, as much as possible, try to avoid working with root priveledges enabled, I often run into troubles with those ...
2
votes
0answers
224 views

unshare -m seemingly not creating mount namespace

I ran unshare -mfp sh -c 'mount -tproc none /proc ; ls /proc' That printed a /proc with only directories for PID 1 and PID 3, and exited, leaving me back in my old prompt in the root namespace, as ...
2
votes
0answers
1k views

Netlink access inside a network namespace

I'm trying set up an IPsec gateway (strongSwan) on a Raspberry Pi 2. The Pi was already providing a number of services on the LAN using a private IP address. My initial attempt to turn it into an ...
2
votes
1answer
977 views

Is Traffic control inside namespace on ports created by OpenvSwitch supported?

I am trying to limit the bandwidth of an interface inside a namespace using tc without much success. Seems it's not supported according to https://lists.linux-foundation.org/pipermail/containers/2009-...
1
vote
0answers
28 views

How to use host PTY in container?

I'm learning about container technologies of Linux and wrote a minimal container implementation on my own. I'm currently confused about consoles / terminals for container processes, as I'm "reusing" ...
1
vote
1answer
351 views

systemd “Failed to set up mount namespacing” in Docker container

I recently updated a Docker that uses systemd internally from Debian stretch to Debian buster. And since then it's not working. So accoding to systemctl status it fails to setup the namespace: Dec ...
1
vote
0answers
19 views

Crtl-C does not kill AppArmour and namespace sandboxed process

Given this AppArmour profile (intended to avoid manipulation of git repositories): /RISC_OS { signal, ptrace, unix, network, / mrixwlk, /** mrixwlk, deny /**/.git** wl, deny /**/refs/...
1
vote
0answers
194 views

fuse allow_root is not set - why files in user mount is seen via sudo?

Why root can see user files when allow_root is not set by fuse? (user2 get permission denied for ls /media/user1/Data, but can see files via sudo, Linux Mint 19). user2@PC:~$ cat /etc/fuse.conf ... # ...
1
vote
0answers
297 views

Could not display /location “the location is not a folder” error - mount of other user displayed in Nemo file manager

I added another say user2 on Linux Mint system (19.2), logged-on and started X, then Nemo file manager. On the left on Devices expandable list I see links e.g. /media/user1/data (/dev/sda5), when I ...
1
vote
0answers
89 views

mount proc filestsrem inside namespace

I had a rootfs of a linux os (like ubuntu or centos) and removed mount command inside that . now, is there any way to mount proc filesystem with nsenter or unshare or any other command inside a ...
1
vote
0answers
57 views

Running su inside mount namespace

I am testing mount namespace using the following steps: # unshare --mount # mount --bind rootfs/ ns_dir/ # cd ns_dir/ # pivot_root . . # cd / My rootfs has sub-folders /lib, /bin, /etc. I have put ...
1
vote
0answers
351 views

Using socat to access deluge daemon in a different namespace

I'm using namespaced-openvpn to ensure that my torrent traffic in deluge is always behind a VPN. A modified script from this blog post helped to connect the VPN namespace to the real network: ip ...
1
vote
0answers
174 views

Access usb wireless adapter from network namespace

I have a wireless usb adapter and I would like my docker container to use just this for the internet (not the computers own wireless adapter). I think I can do this if I know how to access the adapter ...
1
vote
1answer
195 views

Linux mount namespace hopping considered harmful?

In an application, I need to temporarily "switch" into a specific mount namespace to check some things inside it in /proc, then switch back to the mount namespace my application was started with, then ...
1
vote
2answers
2k views

Internet connectivity using linux network namespace

I experimenting with Linux namespaces on Ubuntu 17.1 distro. Ultimate goal is to force an application to use a particular network interface via a 3G modem not the intranet wired connection. My PC has ...
1
vote
0answers
48 views

Creating a private tmpfs mount in a shell script

Is there any command that can be utilized in a shell script to create a mount namespace? What it is and how do I use it? Does it get disposed of when the calling script exits?
1
vote
0answers
66 views

Is an unprivileged LXC where the host user itself is mapped to 0 less secure of one where one of its subids is mapped to 0, and why?

Instead of creating "common" LXC unprivileged containers where all the users are mapped to (unprivileged) subuid/gid of my host user, I'm considering a mapping where my host user itself will be mapped ...
1
vote
1answer
324 views

Recursively unmount Bind mount in both User and Mount namespace

I am trying to use recursive bind mount in a new user namespace and mount namespace. This is what I do. Assume /foo/bar/ and /foo are both mount points. Firstly I do mount --rbind /foo/bar/ /baz, and ...
1
vote
0answers
109 views

Is it allowed to assign one range of subordinate IDs to two different users?

Is it allowed to assign the same range of subordinate user and group IDs to different users on the system defining the subordinate IDs? Please provide sources for your answer. The idea here would be ...
1
vote
0answers
106 views

icmp limited in many network spaces?

I wrote small script do show example usage of ip netns on unused class size C (here changed into 192.168.10) #!/bin/sh network=192.168.10 for id in `seq 0 127`; do ip netns del test-$id; done; ...
1
vote
0answers
623 views

Running HTTP process as a sole child in PID/NET namespace

First time posting here so I appreciate your help and patience. After reading about namespaces, looking on various forums including this thread and trial and error I'm still looking for answers for a ...
1
vote
0answers
648 views

How to start a process chain from the shell

Is it possible and if so how do I: Start a /bin/bash process that is not bound to a terminal from a terminal? Hence, a shell process that shows up in the process tree as init -- bash. (Shells usually ...
0
votes
0answers
48 views

Running multiple isolated NFS Servers

I have a computer on my network which I want to run multiple NFS servers on. Let's say I have a directory /export, and inside I have dir1, dir2, etc, and I want to export the directories under /export ...
0
votes
1answer
166 views

Extra mount points for systemd service

I am trying to set up a systemd service which needs to have access to a filesystem I don’t normally want mounted (in case it’s relevant, I want to set up Snapper on btrfs, but want to use a flat ...
0
votes
0answers
46 views

Is there a way to give a user access to a file without adding it to sudoers?

My monitoring system runs with lowered permissions but I want it to run a command that needs access a particular file in a folder that the monitoring system is not allowed to enter. The usual ...