Questions tagged [namespace]

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

Filter by
Sorted by
Tagged with
36
votes
2answers
20k views

What's a UTS namespace?

The man page of unshare says: UTS namespace setting hostname, domainname will not affect rest of the system (CLONE_NEWUTS flag) What does UTS stand for?
27
votes
4answers
20k views

How to list namespaces in Linux?

Is there any method in Linux to list all namespaces on the running host? I need to check namespaces for particular processes (e.g. processes running in LXC-container and all other processes on the ...
25
votes
5answers
28k views

how to find out namespace of a particular process?

I already asked a question about how to list all namespaces in Linux, but there wasn't any correct and exact answers, so I want to find out a method which can help me to find out the namespace of PID ...
23
votes
2answers
12k views

per process private file system mount points

I was checking unshare command and according to it's man page, unshare - run program with some namespaces unshared from parent I also see there is a type of namespace listed as, mount namespace ...
15
votes
3answers
7k views

kernel: Namespaces support

I am wondering what exactly the “Namespaces support” feature in the Linux kernel means. I am using kernel 3.11.1 (the newest stable kernel at this time). If I decide to disable it, will I notice any ...
15
votes
1answer
7k views

Reliable way to jail child processes using `nsenter:`

I know that Linux namespaces, among many other things, can be leveraged to handle restricting and jailing child processes securely without any chance of their being zombied and dumped on init. But I'm ...
15
votes
3answers
3k views

Command to run a child process “offline” (no external network) on Linux

I have a program I would like to test in offline mode without taking down my actual network. This program would still need to connect to local sockets, including unix domain sockets and loopback. It ...
14
votes
1answer
3k views

How to perform chroot with Linux namespaces?

After reading about Linux namespaces I was under the impression that they are, amongst a lot of other features, an alternative to chroot. For example, in this article: Other uses [of namespaces] ...
13
votes
1answer
1k views

Why can't I bind-mount “/” inside a user namespace?

Why doesn't this work? $ unshare -rm mount --bind / /mnt mount: /mnt: wrong fs type, bad option, bad superblock on /, missing codepage or helper program, or other error. These work ok: $ unshare -...
13
votes
2answers
4k views

Simulate chroot with unshare

I am trying to write a bootstrapper for a minimal, from-source linux distribution. I would like to build in a chroot-like environment. This should simplify packaging. I do not care about security at ...
12
votes
2answers
2k views

Why is my bind mount visible outside its mount namespace?

So I'm trying to get a handle on how Linux's mount namespace works. So, I did a little experiment and opened up two terminals and ran the following: Terminal 1 root@goliath:~# mkdir a b root@...
11
votes
4answers
3k views

Is it possible to run 'unshare -n [program]' as an unprivileged user?

I want to run a program without any internet access, e.g. unshare -n ping 127.0.0.1. As an unprivileged user, it returns Operation not permitted, as a privileged user, it returns the desired ...
9
votes
1answer
19k views

What characters are valid to use in filenames? [duplicate]

I seems like it is possible to create filenames in unix with just about any valid character. touch \; && touch \\ && touch \" && touch $'\n' && touch $'\t' && ...
8
votes
2answers
2k views

View/manipulate mount namespaces in Linux

Is there any way to view or manipulate the mount namespace for an arbitrary process? For example, a docker container is running which has a local mount to an NFS server. It can be seen from inside ...
8
votes
1answer
4k views

Creating VLANs between network namespaces

I want to implement the topology shown in the figure below using network namespaces (ns1 to ns4).                  ...
7
votes
4answers
326 views

Clean way to temporarily replace a config file?

I use a drawing program called Inkscape, which has both a GUI and a command line interface. When used on the command line, it has a large number of options that can only be controlled through a user-...
7
votes
1answer
665 views

Losing permissions by adding capability?

I observed the following phenomenon that I can not explain. After adding the CAP_SYS_ADMIN capability, unshare is no longer able to write to /proc/self/setgroups. In fact, writing to this file ...
7
votes
2answers
1k views

Mounting a file system image inside an unshared namespace

I'm using unshare to perform things like bind mounts local to a certain process without requiring root access, e.g.: unshare -mr bash mount --bind a b (Yes, this seems kinda dumb; in my actual use ...
7
votes
2answers
3k views

How to whitelist directories for Units in systemd

There are many options available for Units (like services) in systemd. Three of them are called ReadWriteDirectories, ReadOnlyDirectories and InaccessibleDirectories. I'm using Debian 8.5 on a virtual ...
6
votes
4answers
8k views

linux namespace, How to connect internet in network namespace?

I want to test linux network namespace. The current problem is I cannot connect internet in the namespace here is my commands: 1 Create network namespace netns1, create a pair of veths (A and B) ...
6
votes
3answers
495 views

What happens if the last process in a namespace exits?

I am running Linux. I have a single process in a mount namespace. I did in this process a mount -t tmpfs tmpfs /mountpoint. What happens if the process exits and there are no more processes in ...
6
votes
1answer
666 views

LXC: Any security difference between root and end-user owned unprivileged containers?

I intend to use LXC containers to isolate most of the network facing services. As per my understanding, I have mainly two ways to do this: Create unprivileged containers owned by root. In this case, ...
6
votes
0answers
254 views

How can I make a device available inside a systemd-nspawn container with user namespacing?

I would like to mount an encrypted image file using cryptsetup inside a systemd-nspawn container. However, I get this error message: [root@container ~]# echo $key | cryptsetup -d - open luks.img luks ...
6
votes
0answers
438 views

What network connections are not seen by netstat/lsof/ss?

Network monitoring tools ss, lsof -i, netstat -ltupw and similar have limitations like namespace and thus they don't show the whole machine connections. (for namespace created with ip we can see other ...
5
votes
2answers
2k views

What is the NSFS filesystem?

The kernel contains a filesystem, nsfs. snapd creates a nsfs mount under /run/snapd/ns/<snapname>.mnt for each installed snap. ls shows it as a 0 byte file. The kernel source code does not seem ...
5
votes
2answers
196 views

how to change a file's content for a specific process only?

For the purpose of this question, let us assume that there is a file (/path/to/file) in the filesystem with a certain content like this: $> cat /path/to/file this is the content of the file /path/...
5
votes
2answers
3k views

In a UID namespace, can I setuid to an unmapped UID?

Suppose I'm user ID 1000. I run a program inside a UID namespace, mapping UID 0 inside the namespace to UID 1000 outside the namespace. The program then attempts to change its own UID to 50, which ...
5
votes
2answers
7k views

How to assign an additional IP/hostname to a chrooted environment?

While I can simply have e.g. sshd in a chroot environment ("chrootenv") listen to a different port than its parent ("parentenv"), it would be more convenient to have that environment have an ...
5
votes
2answers
2k views

Separate DNS configuration in each network namespace

I've set up several network namespaces on my Linux system (kernel version 3.10), and now I want to configure each network namespace to have its own DNS settings. I created resolv.conf files in each /...
5
votes
1answer
6k views

routing between linux namespaces

I have the following network topology using linux namespaces: .--------.veth0 .--------.veth2 .--------. | ns_snd |------------| ns_mid |------------| ns_rcv | '--------' veth1'-----...
5
votes
1answer
2k views

Network namespaces and public IP

To start, I've read this great article on network namespaces so I know more or less what network namespaces do and how to configure them. The actual problem I'm facing is this: I want to run some ...
5
votes
2answers
364 views

How do I find all interfaces that have been configured in Linux, including those of containers?

I know that you can display interfaces by doing ip a show. That only displays the interfaces that the host can see, but virtual interfaces configured by containers don't appear in this list. I've ...
5
votes
1answer
497 views

PID in arch-chroot is incorrect

I am trying to run a python script in a chroot (specifically, the chroot is created with arch-chroot). The python script relies on os.getpid(), but this seems to be returning an incorrect PID within ...
5
votes
1answer
681 views

First process in a new Linux user namespace needs to call setuid()?

I'm learning about Linux user namespaces and I'm observing a strange behavior which isn't completely clear to me. I've created a range of UIDs in initial user namespaces to which I can map UIDs in ...
5
votes
1answer
3k views

LXC container to use “virtual” interface from host (namespace semantics)

So according to the documentation on the Ubuntu LXC documentation the following statement can be found at the time of this writing: A NIC can only exist in one namespace at a time, so a physical ...
5
votes
1answer
3k views

How to move process from one namespace to other?

This question is similar to my question about how to list namespaces. So in addtition, I'd like to know some information about moving processes from one namespace to other? E.g. I have processes of ...
5
votes
1answer
997 views

unshare --map-root-user switch to original uid/username after setup

I'm using unshare to create per process mounts, which is working perfectly fine by unshare -m --map-root-user However, after having created my bind-mounts by mount --bind src dst I want to change ...
5
votes
0answers
1k views

Persistent network namespace configuration

When creating a namespace with ip netns add <namespace> the namespace and it's related config is deleted on reboot along with created interfaces like veth pairs. What is the correct way to: ...
5
votes
1answer
372 views

Sandboxing a binary on linux

I am trying to understand various options I have to restrict/sandbox a binary in Linux. I see that I can use namespaces and cgroups like docker does. I could use SELinux like this link suggests. Which ...
4
votes
1answer
389 views

Re-enter PID 1 namespace

I'm trying to enter PID namespace that process with PID 1 is in from a process cloned with CLONE_NEWPID. I keep getting Invalid argument error. In other words, I clone a child process with clone() ...
4
votes
1answer
1k views

Switching into a network namespace does not change /sys/class/net?

The Linux man page for network namespaces(7) says: Network namespaces provide isolation of the system resources associated with networking: [...], the /sys/class/net directory, [...]. However, ...
4
votes
1answer
994 views

Did the pivot_root() documentation anticipate the feature of mount namespaces?

pivot_root() moves the root filesystem of the calling process to the directory put_old and makes new_root the new root filesystem of the calling process. The typical use of pivot_root(...
4
votes
1answer
880 views

Linux Capabilities with User Namespaces

I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability. ...
4
votes
3answers
4k views

Trying to run OpenVPN in Network Namespace

I want certain apps to access the internet via OpenVPN. I found a solution in the final answer/comment at the bottom of this question/thread here: Feed all traffic through OpenVPN for a specific ...
4
votes
1answer
3k views

Is there a command to switch to into an existing namespace?

I am using multiple UTS namespaces, each of them has some servers constantly running. I can get the namespace IDs via readlink /proc/<pid>/ns/uts, now I would like to change into a given ...
4
votes
1answer
130 views

Is there a file that associates a thread to its network namespace?

/proc/[pid]/ns/net contains a link to the inode representing the network namespace of the process with PID [pid]. Is there something similar for threads? My use case is a multi-threaded application, ...
4
votes
0answers
70 views

When does Linux “garbage-collect” namespaces?

My current understanding of Linux (kernel) namespaces is that their lifetime after creation is as long as at least one of the following conditions holds true: at least one process/thread is joined (...
4
votes
0answers
382 views

Why does `systemd-nspawn -n` network namespace not show in `ip netns list`?

tl;dr Linux has namespaces, in particular, network namespaces. It seems the namespace supposedly created via the -n flag when running systemd-nspwawn does not show up when employing ip netns list (...
4
votes
1answer
568 views

why is CAP_SYS_ADMIN needed for CLONE_NEWPID?

man 2 unshare tells us Use of CLONE_NEWPID requires the CAP_SYS_ADMIN capability and the suggested reading for further information man 7 pid_namespaces does not really discuss the presumable risk ...
3
votes
2answers
4k views

How to make reachable macvlan aliases in a different namespaces?

I have an interface, name eth0, in my main network namespace another interface, name jail0, in an alternate network namespace (name name0). This namespace is used by a jailed environment. jail0 is a ...