3 ms·
Is it possible to create pid_namespaces for unprivileged users by wrapping pid_namespaces creation in a suid shell script that will take care of loading everith
by mingodad 10y ago
Is it possible to create pid_namespaces for unprivileged users by wrapping pid_namespaces creation in a suid shell script that will take care of loading everithing using the current unprivileged user ?
- yjftsjthsd-h 10y agoShell scripts can't be suid. But a binary wrapper could work.
- mrunalp 10y agoIf you enable user namespaces as well, then you don't need any of that. For example: [mrunal@local rootfs]$ id uid=1000(mrunal) gid=1000(mrunal) groups=1000(mrunal),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 [mrunal@local rootfs]$ unshare -m -u -n -i -p -f --mount-proc -r sh sh-4.4# ps -ef UID PID PPID C STIME TTY TIME CMD root 1 0 0 09:42 pts/12 00:00:00 sh root 2 1 0 09:42 pts/12 00:00:00 ps -ef sh-4.4#