Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [userns]

User namespaces or short `userns` is a facility that allows a sub-namespace to have its own set of UIDs and GIDs. This allows to use the least privilege principle for LXC containers, but it's not limited to that use case.

1
vote
0answers
36 views

Why would creating a user namespace with size 1 work but size >1 fail

I am experimenting with unprivileged linux containers and I am writing a Go program that creates a minimalist container. The program forks itself and creates namespaces in the process. However for ...
1
vote
2answers
52 views

Who would win, RLIMIT_NPROC or user namespaces?

Depending on configuration, unprivileged (non-root) processes can create a user namespace. RLIMIT_NPROC limits the number of processes per user. If I enter a user namespace, can I create processes ...
3
votes
1answer
136 views

Ping not working in a new C container

I've been working on writing my own Linux container from scratch in C. I've borrowed code from several places and put up a basic version with namespaces & cgroups. Basically, I clone a new ...
13
votes
1answer
767 views

Why can't I bind-mount “/” inside a user namespace?

Why doesn't this work? $ unshare -rm mount --bind / /mnt mount: /mnt: wrong fs type, bad option, bad superblock on /, missing codepage or helper program, or other error. These work ok: $ unshare -...
6
votes
1answer
7k views

How to enable user_namespaces in the kernel? (For unprivileged `unshare`.)

My Linux kernel must have been configured with user_namespaces when built, but their use is restricted after boot and has to be explicitly enabled. Which sysctl should I use? (If this was turned on, ...
4
votes
1answer
445 views

Mounting Overlayfs in a user namespace

Is it possible to mount an Overlayfs filesystem as an unprivileged user in a user namespace in Linux kernels >4.3.3; it seems that the fix to this vulnerability has blocked this functionality entirely....
2
votes
1answer
756 views

What makes firefox inside a container launch a new firefox window outside on the host with the UID of the host user? Isn't it weird for an LXC?

Can someone please explain this weird behaviour to me: I have an unpriviliged LXC container with firefox inside. If firefox is running on the host outside of the container, /usr/bin/firefox inside ...
2
votes
0answers
345 views

I have trouble analysing the cause of this (firefox) segfault

When executed within a minimal (unprivileged) LXC container, firefox segfaults (other graphical applications work fine). I'am unable to find the exact cause of this segfault (which is most likely due ...
2
votes
0answers
269 views

How to map a UID to another UID (!= 0) inside a user namespace?

How can one map UID 1000 to another regular UID (not root/0) inside a user namespace? EDIT: For anyone interested, https://linuxcontainers.org/lxc/manpages/man5/lxc.container.conf.5.html lists an ...
3
votes
1answer
152 views

Why can't a UID 0 process hardlink to SUID files in a user namespace?

Consider the following transcript of a user-namespaced shell running with root privileges (UID 0 within the namespace, unprivileged outside): # cat /proc/$$/status | grep CapEff CapEff: ...
1
vote
0answers
100 views

Is it allowed to assign one range of subordinate IDs to two different users?

Is it allowed to assign the same range of subordinate user and group IDs to different users on the system defining the subordinate IDs? Please provide sources for your answer. The idea here would be ...
4
votes
3answers
2k views

How can I list all connections to my host, including those to LXC guests?

I tried both netstat and lsof, but it appears it's not possible to see the connections to my LXC guests. Is there a way to achieve this ... for all guests at once? Essentially what throws me off ...
1
vote
1answer
1k views

Can't connect to the sshd in my unprivileged LXC guest. What to do?

So you configured your unprivileged LXC guest, by defining lxc.id_map = u 0 1000000000 10000 lxc.id_map = g 0 1000000000 10000 and of course assigning those subordinate UID/GID ranges to an existing ...
2
votes
0answers
198 views

Is it possible to register “virtual” user/group IDs in a Linux system?

Is there a standardized mechanism in Linux which can be used to tie usernames to user IDs without actually creating a system account that can log in? It would seem something like this is possible, ...
20
votes
2answers
7k views

What is an unprivileged LXC container?

What does it mean if a Linux container (LXC container) is called "unprivileged"?
8
votes
1answer
8k views

userns container fails to start, how to track down the reason?

When creating a userns (unprivileged) LXC container on Ubuntu 14.04 with the following command line: lxc-create -n test1 -t download -- -d $(lsb_release -si|tr 'A-Z' 'a-z') -r $(lsb_release -sc) -a $(...
3
votes
1answer
772 views

How to influence the assignment of subordinate UIDs/GIDs when creating user accounts?

To my knowledge the subordinate UIDs and GIDs are assigned to accounts in such a manner that they form a contiguous range. The range starts at 100000 by default and probably stretches to the ...
7
votes
1answer
1k views

Subordinate GIDs/UIDs with LXC and userns for unprivileged user?

When using userns (via LXC in my case), you assign a range of subordinate GIDs and UIDs to an unprivileged user. See for resources: subuid(5), subgid(5), newuidmap(1), newgidmap(1), user_namespaces(7)....
1
vote
1answer
138 views

How do I conserve the userns UID/GID mappings when archiving an LXC guest?

I'd like to archive an existing LXC container that has been configured to run as unprivileged LXC container (see this question). How can I conserve all the file system meta-data that is used to store ...
7
votes
3answers
2k views

Migrate an unprivileged LXC container between users

I have an Ubuntu 14.04 server installation which acts as an LXC host. It has two users: user1 and user2. user1 owns an unprivileged LXC container, which uses a directory (inside /home/user1/.local/......
14
votes
1answer
3k views

Is there a tool(!) to list assigned subuid and subgid values for users?

usermod -v (--add-sub-uids) and usermod -w (--add-sub-gids) can be used to manipulate the subuid and subgid ranges for a user account, but there appears to be no tool that can merely list them. Is ...
5
votes
4answers
6k views

Building unprivileged (userns) LXC container from scratch, by migrating a privileged container to be unprivileged

How can I build a privileged LXC (1.0.3) container (that part I know) and then migrate it successfully to be run unprivileged? That is, I'd like to debootstrap it myself or adjust the lxc-ubuntu ...