How to make unshare(CLONE_NEWUSER) succeed after chroot?
My call to unshare(CLONE_NEWUSER) when called as a non-root user returns EPERM because of this (http://man7.org/linux/man-pages/man2/unshare.2.html):
EPERM (since Linux 3.9)
CLONE_NEWUSER was specified in flags and the caller is in a
chroot environment (i.e., the caller's root directory does not
match the root directory of the mount namespace in which it
resides).
I've used pivot_root(2) (at that time, running as root) rather than chroot(2) to get into this directory. I'verified that skipping the pivot_root(2) call makes unshare(CLONE_NEWUSER) succeed as a non-root user. But I want both: pivot_root(2) and unshare(CLONE_NEWUSER). I've tried adding unshare(CLONE_NEWNS) just after the pivot_root(2), but that didn't work, I'm still getting EPERM from unshare(CLONE_NEWNS). How can I make it succeed?
FYI I need this because I want to create a rootless container manually inside a chroot-like environment.
linux chroot unshare
edited Jan 6 at 21:06
Rui F Ribeiro
39.5k1479132
asked Jan 5 at 17:40
ptspts
384413
add a comment |
My call to unshare(CLONE_NEWUSER) when called as a non-root user returns EPERM because of this (http://man7.org/linux/man-pages/man2/unshare.2.html):
EPERM (since Linux 3.9)
CLONE_NEWUSER was specified in flags and the caller is in a
chroot environment (i.e., the caller's root directory does not
match the root directory of the mount namespace in which it
resides).
I've used pivot_root(2) (at that time, running as root) rather than chroot(2) to get into this directory. I'verified that skipping the pivot_root(2) call makes unshare(CLONE_NEWUSER) succeed as a non-root user. But I want both: pivot_root(2) and unshare(CLONE_NEWUSER). I've tried adding unshare(CLONE_NEWNS) just after the pivot_root(2), but that didn't work, I'm still getting EPERM from unshare(CLONE_NEWNS). How can I make it succeed?
FYI I need this because I want to create a rootless container manually inside a chroot-like environment.
linux chroot unshare
edited Jan 6 at 21:06
Rui F Ribeiro
39.5k1479132
asked Jan 5 at 17:40
ptspts
384413
NEWUSER before pivot_root(), maybe?
– sourcejedi
Jan 5 at 18:02
@sourcejedi: These are two different processes. The first process calls pivot_root(2) as root, then some other work is done, then another process running as non-root wants to call unshare(CLONE_NEWUSER), and that one fails. How do I make that one succeed? Could you please clarfiy?
– pts
Jan 5 at 20:29
1
Please note you should callchroot("/");(orchroot(".");if you're chdir'd to that directory) right afterpivot_root. Are you doing that? Can you share a small reproducer that illustrates the issue you're running into?
– filbranden
Jan 5 at 21:39
@pts I guess I didn't read the last sentence of your question, sorry. I believe we can work this out if we have a small reproducer to look at, as suggested.
– sourcejedi
Jan 5 at 21:53
add a comment |
My call to unshare(CLONE_NEWUSER) when called as a non-root user returns EPERM because of this (http://man7.org/linux/man-pages/man2/unshare.2.html):
EPERM (since Linux 3.9)
CLONE_NEWUSER was specified in flags and the caller is in a
chroot environment (i.e., the caller's root directory does not
match the root directory of the mount namespace in which it
resides).
I've used pivot_root(2) (at that time, running as root) rather than chroot(2) to get into this directory. I'verified that skipping the pivot_root(2) call makes unshare(CLONE_NEWUSER) succeed as a non-root user. But I want both: pivot_root(2) and unshare(CLONE_NEWUSER). I've tried adding unshare(CLONE_NEWNS) just after the pivot_root(2), but that didn't work, I'm still getting EPERM from unshare(CLONE_NEWNS). How can I make it succeed?
FYI I need this because I want to create a rootless container manually inside a chroot-like environment.
linux chroot unshare
edited Jan 6 at 21:06
Rui F Ribeiro
39.5k1479132
asked Jan 5 at 17:40
ptspts
384413
My call to unshare(CLONE_NEWUSER) when called as a non-root user returns EPERM because of this (http://man7.org/linux/man-pages/man2/unshare.2.html):
EPERM (since Linux 3.9)
CLONE_NEWUSER was specified in flags and the caller is in a
chroot environment (i.e., the caller's root directory does not
match the root directory of the mount namespace in which it
resides).
I've used pivot_root(2) (at that time, running as root) rather than chroot(2) to get into this directory. I'verified that skipping the pivot_root(2) call makes unshare(CLONE_NEWUSER) succeed as a non-root user. But I want both: pivot_root(2) and unshare(CLONE_NEWUSER). I've tried adding unshare(CLONE_NEWNS) just after the pivot_root(2), but that didn't work, I'm still getting EPERM from unshare(CLONE_NEWNS). How can I make it succeed?
FYI I need this because I want to create a rootless container manually inside a chroot-like environment.
linux chroot unshare
linux chroot unshare
edited Jan 6 at 21:06
Rui F Ribeiro
39.5k1479132
asked Jan 5 at 17:40
ptspts
384413
edited Jan 6 at 21:06
Rui F Ribeiro
39.5k1479132
asked Jan 5 at 17:40
ptspts
384413
edited Jan 6 at 21:06
Rui F Ribeiro
39.5k1479132
edited Jan 6 at 21:06
Rui F Ribeiro
39.5k1479132
edited Jan 6 at 21:06
Rui F Ribeiro
39.5k1479132
39.5k1479132
asked Jan 5 at 17:40
ptspts
384413
asked Jan 5 at 17:40
ptspts
384413
asked Jan 5 at 17:40
ptspts
384413
384413
NEWUSER before pivot_root(), maybe?
– sourcejedi
Jan 5 at 18:02
@sourcejedi: These are two different processes. The first process calls pivot_root(2) as root, then some other work is done, then another process running as non-root wants to call unshare(CLONE_NEWUSER), and that one fails. How do I make that one succeed? Could you please clarfiy?
– pts
Jan 5 at 20:29
1
Please note you should callchroot("/");(orchroot(".");if you're chdir'd to that directory) right afterpivot_root. Are you doing that? Can you share a small reproducer that illustrates the issue you're running into?
– filbranden
Jan 5 at 21:39
@pts I guess I didn't read the last sentence of your question, sorry. I believe we can work this out if we have a small reproducer to look at, as suggested.
– sourcejedi
Jan 5 at 21:53
add a comment |
NEWUSER before pivot_root(), maybe?
– sourcejedi
Jan 5 at 18:02
@sourcejedi: These are two different processes. The first process calls pivot_root(2) as root, then some other work is done, then another process running as non-root wants to call unshare(CLONE_NEWUSER), and that one fails. How do I make that one succeed? Could you please clarfiy?
– pts
Jan 5 at 20:29
1
Please note you should callchroot("/");(orchroot(".");if you're chdir'd to that directory) right afterpivot_root. Are you doing that? Can you share a small reproducer that illustrates the issue you're running into?
– filbranden
Jan 5 at 21:39
@pts I guess I didn't read the last sentence of your question, sorry. I believe we can work this out if we have a small reproducer to look at, as suggested.
– sourcejedi
Jan 5 at 21:53
NEWUSER before pivot_root(), maybe?
– sourcejedi
Jan 5 at 18:02
NEWUSER before pivot_root(), maybe?
– sourcejedi
Jan 5 at 18:02
@sourcejedi: These are two different processes. The first process calls pivot_root(2) as root, then some other work is done, then another process running as non-root wants to call unshare(CLONE_NEWUSER), and that one fails. How do I make that one succeed? Could you please clarfiy?
– pts
Jan 5 at 20:29
@sourcejedi: These are two different processes. The first process calls pivot_root(2) as root, then some other work is done, then another process running as non-root wants to call unshare(CLONE_NEWUSER), and that one fails. How do I make that one succeed? Could you please clarfiy?
– pts
Jan 5 at 20:29
1
1
Please note you should call
chroot("/"); (or chroot("."); if you're chdir'd to that directory) right after pivot_root. Are you doing that? Can you share a small reproducer that illustrates the issue you're running into?– filbranden
Jan 5 at 21:39
Please note you should call
chroot("/"); (or chroot("."); if you're chdir'd to that directory) right after pivot_root. Are you doing that? Can you share a small reproducer that illustrates the issue you're running into?– filbranden
Jan 5 at 21:39
@pts I guess I didn't read the last sentence of your question, sorry. I believe we can work this out if we have a small reproducer to look at, as suggested.
– sourcejedi
Jan 5 at 21:53
@pts I guess I didn't read the last sentence of your question, sorry. I believe we can work this out if we have a small reproducer to look at, as suggested.
– sourcejedi
Jan 5 at 21:53
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f492688%2fhow-to-make-unshareclone-newuser-succeed-after-chroot%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f492688%2fhow-to-make-unshareclone-newuser-succeed-after-chroot%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
NEWUSER before pivot_root(), maybe?
– sourcejedi
Jan 5 at 18:02
@sourcejedi: These are two different processes. The first process calls pivot_root(2) as root, then some other work is done, then another process running as non-root wants to call unshare(CLONE_NEWUSER), and that one fails. How do I make that one succeed? Could you please clarfiy?
– pts
Jan 5 at 20:29
1
Please note you should call
chroot("/");(orchroot(".");if you're chdir'd to that directory) right afterpivot_root. Are you doing that? Can you share a small reproducer that illustrates the issue you're running into?– filbranden
Jan 5 at 21:39
@pts I guess I didn't read the last sentence of your question, sorry. I believe we can work this out if we have a small reproducer to look at, as suggested.
– sourcejedi
Jan 5 at 21:53