1user_namespaces(7)     Miscellaneous Information Manual     user_namespaces(7)
2
3
4

NAME

6       user_namespaces - overview of Linux user namespaces
7

DESCRIPTION

9       For an overview of namespaces, see namespaces(7).
10
11       User namespaces isolate security-related identifiers and attributes, in
12       particular, user IDs and group IDs (see credentials(7)), the  root  di‐
13       rectory,  keys  (see  keyrings(7)),  and  capabilities  (see  capabili‐
14       ties(7)).  A process's user and group IDs can be different  inside  and
15       outside  a  user namespace.  In particular, a process can have a normal
16       unprivileged user ID outside a user namespace while at  the  same  time
17       having a user ID of 0 inside the namespace; in other words, the process
18       has full privileges for operations inside the user  namespace,  but  is
19       unprivileged for operations outside the namespace.
20
21   Nested namespaces, namespace membership
22       User  namespaces can be nested; that is, each user namespace—except the
23       initial ("root") namespace—has a parent user namespace,  and  can  have
24       zero  or  more child user namespaces.  The parent user namespace is the
25       user namespace of the process that creates the  user  namespace  via  a
26       call to unshare(2) or clone(2) with the CLONE_NEWUSER flag.
27
28       The  kernel  imposes  (since Linux 3.11) a limit of 32 nested levels of
29       user namespaces.  Calls to unshare(2) or clone(2) that would cause this
30       limit to be exceeded fail with the error EUSERS.
31
32       Each process is a member of exactly one user namespace.  A process cre‐
33       ated via fork(2) or clone(2) without the CLONE_NEWUSER flag is a member
34       of  the  same  user namespace as its parent.  A single-threaded process
35       can join another user namespace with setns(2) if it has the CAP_SYS_AD‐
36       MIN  in that namespace; upon doing so, it gains a full set of capabili‐
37       ties in that namespace.
38
39       A call to clone(2) or unshare(2) with the CLONE_NEWUSER flag makes  the
40       new  child process (for clone(2)) or the caller (for unshare(2)) a mem‐
41       ber of the new user namespace created by the call.
42
43       The NS_GET_PARENT ioctl(2)  operation  can  be  used  to  discover  the
44       parental relationship between user namespaces; see ioctl_ns(2).
45
46       A  task that changes one of its effective IDs will have its dumpability
47       reset to the value in /proc/sys/fs/suid_dumpable.  This may affect  the
48       ownership  of proc files of child processes and may thus cause the par‐
49       ent to lack the permissions to write to mapping  files  of  child  pro‐
50       cesses  running in a new user namespace.  In such cases making the par‐
51       ent process dumpable, using PR_SET_DUMPABLE in a call to prctl(2),  be‐
52       fore  creating a child process in a new user namespace may rectify this
53       problem.  See prctl(2) and proc(5) for details on how ownership is  af‐
54       fected.
55
56   Capabilities
57       The  child  process  created  by  clone(2)  with the CLONE_NEWUSER flag
58       starts out with a complete set of capabilities in the  new  user  name‐
59