User namespaces or short `userns` is a facility that allows a sub-namespace to have its own set of UIDs and GIDs. This allows to use the least privilege principle for LXC containers, but it's not limited to that use case.
The Linux kernel allows certain resources to be confined to a namespace. The practical use for this are mostly containers in the LXC sense (see lxc). However, it is also possible to start a single program and limit its view on the system (check out the
man page for
User namespaces (
userns) have been one of the long-awaited features for LXC, since they allow to map an unprivileged user on the host to a range of UIDs in the container and the respective GID accordingly to a range of GIDs. Since the container's processes, network, host name and so on are also confined to their child namespace, this effectively means one can run a full-fledged LXC container from an unprivileged host system account, thus limiting the scope of potential security breaches.
The main goal of
userns is to allow the mapping of a UID (and GID) from the parent namespace into a range of UIDs (and GIDs) in the child namespace. So if you have a user account
joe which is an ordinary unprivileged user on your system, this user could - provided the LXC container is prepared accordingly - run a container and inside the container could act as
root within the boundaries of the namespace, not affecting the host adversely. The kernel would still ensure that all those processes that on the host appear to run as
joe would not be able to do anything fancy with block devices and so on - access would be allowed purely on the basis of
joe's permissions on the host, while inside the container files would still be owned by
root (and whatever users get created there) and permission would be granted or denied based on the
joe's permissions in the parent namespace and then inside the container based on the respective UIDs/GIDs as they appear from inside the container.
So in a sense namespaces (not just
userns) provide a confined view of system resources, allowing fine-grained and secure jailing.