Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 29483

Questions relating to Linux namespaces, including commands such as: unshare and ip netns. Namespaces support isolation of filesystems, system names, IPC, processes, networks, and users. Closely related to the docker and lxc tags; use those tags instead of this one if you are simply using docker or lxc to implement namespaces.

2
votes
. Running readlink / ls -l will show the namespace type, and a unique identifier. You can keep a permanent reference to a namespace by bind-mounting the above files. If you think this sounds a bit weird, I … agree with you, but it can be useful in some cases :-). lsns - It crawls /proc for you, and lists all the different namespaces that are being used. /proc/[pid]/mountinfo describes the mount namespace
answered Mar 7 by sourcejedi
12
votes
Entering a mount namespace before setting up a chroot, lets you avoid cluttering the host namespace with additional mounts, e.g. for /proc. You can use chroot inside a mount namespace as a nice and … entering the mount namespace, you also need mount --make-rslave / or equivalent. Otherwise, all your mount changes propagate to the mounts in the original namespace, including the pivot_root. You …
answered Jul 17 '18 by sourcejedi
3
votes
The child process created by clone(2) with the CLONE_NEWUSER flag starts out with a complete set of capabilities in the new user namespace. Likewise, a process that creates a new user namespace … using unshare(2) or joins an existing user namespace using setns(2) gains a full set of capabilities in that namespace. On the other hand, that process has no capabilities in the parent (in the case of …
answered Mar 14 '18 by sourcejedi
16
votes
The difference is that / has child mounts. Inside a user namespace, you are not allowed to separate inherited mounts from their child mounts. A more obvious example is that you are not allowed to …
answered Jul 18 '18 by sourcejedi
3
votes
changing the root mount to read only on umount. Loosen both of these permission checks to also allow CAP_SYS_ADMIN in any namespace which is privileged towards the userns which originally mounted the filesystem. …
answered Aug 27 '18 by sourcejedi
0
votes
1answer
You can still access files and directories in a different mount namespace, if you have a reference to them. However, currently you can't manipulate (or even list) the mounts of a mount namespace … , if it is not the namespace you are running in. Detached mounts (umount -l) are considered to have no mount namespace and therefore you are not allowed to manipulate them (or list sub-mounts). Is the …
asked Aug 7 '18 by sourcejedi
0
votes
Given that it only affects the mount namespace, I am extremely suspicious that this is due to one of the loop prevention checks for mount namespaces. I do not think it is the exact same case as the …
answered May 5 by sourcejedi
0
votes
See commit 4ce5d2b1a8fd, vfs: Don't copy mount bind mounts of /proc/<pid>/ns/mnt between namespaces propagate_one() calls copy_tree() without CL_COPY_MNT_NS_FILE. In this case, if the tree root is a …
answered Oct 7 '18 by sourcejedi
2
votes
1answer
, missing codepage or helper program, or other error. This is because the kernel code (see extracts below) prevents a simple mount namespace loop. The code comments explain why this is not allowed … . The lifetime of a mount namespace is tracked by a simple reference count. If you have a loop where mount namespaces A and B both reference the other, then both A and B will always have at least one …
asked Oct 7 '18 by sourcejedi
2
votes
1answer
https://github.com/systemd/systemd/issues/9914#issuecomment-416387637 $ uname -r 4.17.18-200.fc28.x86_64 $ unshare -U -r -m # mkdir TMP # mount -t tmpfs tmpfs TMP/ # mount -o remount,ro TMP/ mount: …
asked Aug 27 '18 by sourcejedi
0
votes
other types of Linux namespace. I think there's (at least) one important point I missed. One of the features of namespaces is that they are associated with a user namespace. A user namespace isolates … the "super-user" capabilites, such as CAP_SYS_ADMIN and CAP_NET_RAW. E.g. CAP_NET_RAW can allow access to the raw network packets on net devices - if they are owned by a network namespace, which …
answered Aug 7 '18 by sourcejedi
1
vote
The command you are trying to run would change the root filesystem to read-only. It would affect outside the namespace as well. So you do not have permission. You only want to change one specific mount, the mount inside the namespace. Use this command: mount -o remount,bind,ro / …
answered Mar 27 by sourcejedi
1
vote
1answer
# rpm -q --whatprovides /usr/bin/unshare util-linux-2.32-2.fc28.x86_64 # unshare -r # i.e. the above succeeds, where the following does not. What rule causes this? # rpm -q --whatprovides /usr/sbi …
asked May 10 '18 by sourcejedi
1
vote
caller's root directory does not match the root directory of the mount namespace in which it resides). …
answered May 10 '18 by sourcejedi
3
votes
1answer
foo; chroot foo; cd ..; chroot .). It seems clear that processes have two associated roots: their current chroot the root of their mount namespace After pivot_root(), S must observe that the … root of its mount namespace is equal to its current chroot. Because if there was a deeper root filesystem that it could escape to at a future point, then that root filesystem would be busy and could not …
asked Jun 16 '18 by sourcejedi

15 30 50 per page