Questions tagged [unshare]

The tag has no usage guidance.

3
votes
1answer
60 views

Why can I not bind a mount namespace to a file

I observe the following: As unprivileged user in shell No 1: user@box:~$ sysctl kernel.unprivileged_userns_clone kernel.unprivileged_userns_clone = 1 user@box:~$ unshare --mount --user nobody@box:~$ ...
0
votes
1answer
28 views

Why does unshare binary call clone() so many times?

I am trying to test the unshare command in Linux. I am using it to create a new user namespace. I tried the following test: user1@myPC$ strace -e clone,unshare,fork,execve unshare --user execve("/usr/...
0
votes
0answers
35 views

How to pass a whole code block to unshare?

I want to pass an entire code block to unshare, but I don't see an option to pass a function directly. I currently have a solution with two files: File 1: run_with_bash_as_default_shell.sh sudo ...
3
votes
0answers
96 views

How to make unshare(CLONE_NEWUSER) succeed after chroot?

My call to unshare(CLONE_NEWUSER) when called as a non-root user returns EPERM because of this (http://man7.org/linux/man-pages/man2/unshare.2.html): EPERM (since Linux 3.9) ...
0
votes
0answers
148 views

Filesystem permission problems with user namespaces and debootstrap

I want to build a lightweight process isolation tool built on linux features like namespaces and chroot (in order to understand them better). I am currently running the following commands to start an ...
4
votes
1answer
158 views

How to prevent a process from writing to the systemd journal?

I am using a third party .NET Core application (a binary distribution used by a VS Code extension) that unfortunately has diagnostic logging enabled with no apparent way to disable it (I did already ...
1
vote
1answer
214 views

With Linux user namespaces, why can clone() mount /proc, but unshare() cannot?

I am trying to get a non-root user to mount /proc in a Linux user namespace. If I create a namespace via clone(), then I can mount /proc. However, if I create a namespace via unshare(), then the ...
3
votes
1answer
167 views

Why does unsharing mount namespace require CAP_SYS_ADMIN?

For a project of mine I need only the mount namespace unshared, which requires the CAP_SYS_ADMIN capability (see namespaces). While it is possible to create a new mount-namespace without capabilities ...
0
votes
1answer
138 views

How to `unshare -n` without changing to root?

I'd like to run a shell that behaves exactly like the parent but without network. Why do I have to su <login> after unshare?
7
votes
1answer
385 views

Losing permissions by adding capability?

I observed the following phenomenon that I can not explain. After adding the CAP_SYS_ADMIN capability, unshare is no longer able to write to /proc/self/setgroups. In fact, writing to this file ...
3
votes
1answer
435 views

how to unshare network for current process

It's possible to run a new command without network access as non-root using unshare -r -n, for example: $ unshare -r -n ls a.txt b.txt A command that does require network access will fail ...
0
votes
2answers
97 views

Making a bind-mount take effect only in the context of the current process and its descendants

I have 2 files: /MyDir/a and /MyDir/MySubDir/b and am running a bash script, to which I want to add code to make file /a point to file /b, but only in the current process and its descendants. In ...
5
votes
1answer
576 views

unshare --map-root-user switch to original uid/username after setup

I'm using unshare to create per process mounts, which is working perfectly fine by unshare -m --map-root-user However, after having created my bind-mounts by mount --bind src dst I want to change ...
3
votes
1answer
2k views

How can I check if cgroups are available on my Linux host?

Is there a command to check if the container services are running on a Linux system? Someone suggested unshare but I am not sure if that is the best way to do it.
1
vote
1answer
494 views

Why does unshare based killing only work reliably with --fork?

From this answer we have learned that you can implement reliable killing of entire process subtrees with Linux PID namespaces via unshare -p. Here is problem with it that I don't understand: It only ...
6
votes
2answers
927 views

Mounting a file system image inside an unshared namespace

I'm using unshare to perform things like bind mounts local to a certain process without requiring root access, e.g.: unshare -mr bash mount --bind a b (Yes, this seems kinda dumb; in my actual use ...
2
votes
0answers
32 views

Is there a way to cancel unshare(2)?

If I called unshare ./fooprogram, is there a way to cancel that unshare while fooprogram is running?
3
votes
1answer
631 views

Force program to use /dev/urandom

I'm trying to create a little container that will let me remap /dev/random to /dev/urandom without root for a specific program. What I have so far: unshare -r bash -c 'chroot . /bin/busybox sh' For ...
13
votes
2answers
4k views

Simulate chroot with unshare

I am trying to write a bootstrapper for a minimal, from-source linux distribution. I would like to build in a chroot-like environment. This should simplify packaging. I do not care about security at ...