Questions tagged [unshare]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
2answers
17 views

How can I test that a buildah script is run under buildah-unshare?

If I have a script that uses buildah mount. I use the same way the docs specify, mnt=$(buildah mount $ctr) If I invoke my script sh ./build.sh, I get cannot mount using driver overlay in rootless ...
1
vote
2answers
21 views

unshare -r: Failed to connect to bus: Operation not permitted

When I run unshare -r, I get Failed to connect to bus: Operation not permitted The id still shows I'm root, ❯ id uid=0(root) gid=0(root) groups=0(root),65534(nogroup) What does this error/warning ...
0
votes
0answers
10 views

unshare --map-user: Why doesn't $USER change?

When i use unshare --map-user=root, the $USER variable changes to "root", but if I pass in any other user, the $USER variable doesn't change. Why?
0
votes
1answer
115 views

Why is it possible to create other namespaces without real root using user namespaces?

When using the command unshare to create namespaces, if you are not the root in the host machine and creating any namespace but the user type, you will receive this error: Operation not permitted. ...
2
votes
2answers
111 views

Strange behaviour of pivot_root(“.”, “.”) in mount namespace

I'm trying to understand containers and stumbled upon a trick apparently found by the LXC developers, see this runc PR: You can call pivot_root(".", ".") which avoids the need for a directory to put ...
0
votes
0answers
25 views

Cannot unmount an unshared mount

I'm using namespaces and mountflags to control propagation of mountpoints and/or accessibility to the data within. My setup looks like this: There is a main process A Process A creates process B ...
2
votes
2answers
264 views

“unshare --mount” inside a jenkins chroot environment

In some of my build scripts I've been using mount namespaces as a mechanism to safely mount without ever leaving these mounts behind when the script terminates. Unshared mount points are implicitly ...
0
votes
1answer
433 views

Why unshare -p does not imply -f and --mount-proc?

The man page specifies that you may be interested in using --fork and --mount-proc when creating a PID namespace, but why those options are not default?
3
votes
1answer
410 views

Why can I not bind a mount namespace to a file

I observe the following: As unprivileged user in shell No 1: user@box:~$ sysctl kernel.unprivileged_userns_clone kernel.unprivileged_userns_clone = 1 user@box:~$ unshare --mount --user nobody@box:~$ ...
0
votes
1answer
181 views

Why does unshare binary call clone() so many times?

I am trying to test the unshare command in Linux. I am using it to create a new user namespace. I tried the following test: user1@myPC$ strace -e clone,unshare,fork,execve unshare --user execve("/usr/...
3
votes
0answers
305 views

How to make unshare(CLONE_NEWUSER) succeed after chroot?

My call to unshare(CLONE_NEWUSER) when called as a non-root user returns EPERM because of this (http://man7.org/linux/man-pages/man2/unshare.2.html): EPERM (since Linux 3.9) ...
4
votes
1answer
706 views

How to prevent a process from writing to the systemd journal?

I am using a third party .NET Core application (a binary distribution used by a VS Code extension) that unfortunately has diagnostic logging enabled with no apparent way to disable it (I did already ...
3
votes
1answer
582 views

With Linux user namespaces, why can clone() mount /proc, but unshare() cannot?

I am trying to get a non-root user to mount /proc in a Linux user namespace. If I create a namespace via clone(), then I can mount /proc. However, if I create a namespace via unshare(), then the ...
3
votes
1answer
369 views

Why does unsharing mount namespace require CAP_SYS_ADMIN?

For a project of mine I need only the mount namespace unshared, which requires the CAP_SYS_ADMIN capability (see namespaces). While it is possible to create a new mount-namespace without capabilities ...
0
votes
1answer
539 views

How to `unshare -n` without changing to root?

I'd like to run a shell that behaves exactly like the parent but without network. Why do I have to su <login> after unshare?
8
votes
1answer
959 views

Losing permissions by adding capability?

I observed the following phenomenon that I can not explain. After adding the CAP_SYS_ADMIN capability, unshare is no longer able to write to /proc/self/setgroups. In fact, writing to this file ...
3
votes
1answer
1k views

how to unshare network for current process

It's possible to run a new command without network access as non-root using unshare -r -n, for example: $ unshare -r -n ls a.txt b.txt A command that does require network access will fail ...
1
vote
2answers
322 views

Making a bind-mount take effect only in the context of the current process and its descendants

I have 2 files: /MyDir/a and /MyDir/MySubDir/b and am running a bash script, to which I want to add code to make file /a point to file /b, but only in the current process and its descendants. In ...
7
votes
1answer
1k views

unshare --map-root-user switch to original uid/username after setup

I'm using unshare to create per process mounts, which is working perfectly fine by unshare -m --map-root-user However, after having created my bind-mounts by mount --bind src dst I want to change ...
4
votes
1answer
7k views

How can I check if cgroups are available on my Linux host?

Is there a command to check if the container services are running on a Linux system? Someone suggested unshare but I am not sure if that is the best way to do it.
3
votes
1answer
929 views

Why does unshare based killing only work reliably with --fork?

From this answer we have learned that you can implement reliable killing of entire process subtrees with Linux PID namespaces via unshare -p. Here is problem with it that I don't understand: It only ...
7
votes
2answers
2k views

Mounting a file system image inside an unshared namespace

I'm using unshare to perform things like bind mounts local to a certain process without requiring root access, e.g.: unshare -mr bash mount --bind a b (Yes, this seems kinda dumb; in my actual use ...
3
votes
1answer
72 views

Is there a way to cancel unshare(2)?

If I called unshare ./fooprogram, is there a way to cancel that unshare while fooprogram is running?
3
votes
1answer
926 views

Force program to use /dev/urandom

I'm trying to create a little container that will let me remap /dev/random to /dev/urandom without root for a specific program. What I have so far: unshare -r bash -c 'chroot . /bin/busybox sh' For ...
13
votes
2answers
5k views

Simulate chroot with unshare

I am trying to write a bootstrapper for a minimal, from-source linux distribution. I would like to build in a chroot-like environment. This should simplify packaging. I do not care about security at ...