3 ms·

With mount namespaces, you can create an anonymous tmpfs mount that gets detached and deleted once nothing refers to it any more, and add whatever files you wan

With mount namespaces, you can create an anonymous tmpfs mount that gets detached and deleted once nothing refers to it any more, and add whatever files you want to that. It can be accessed using the *at() syscalls, or alternatively using an initial fchdir() to make it the current directory. Too bad that unprivileged namespaces have been buried by the big-name distros, though.

bduffany 2y ago
What do you mean by unprivileged namespaces being buried by the big-name distros?
- happymellon 2y ago
  Presumably this, Unprivileged Name Spaces getting blocked by Ubuntu. Not sure if anyone else is doing it. https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged...
  - LegionMammal978 2y ago
    It seems that until 2020, Debian used to block them as well [0]. So perhaps some of my perceptions are out of date. In any case, it means namespaces are unreliable to use for the typical Linux program. [0] https://salsa.debian.org/kernel-team/linux/-/commit/a381917851e762684ebe28e04c5ae0d8be7f42c7 https://salsa.debian.org/kernel-team/linux/-/commit/a3819178...
- LegionMammal978 2y ago
  Well, perhaps I'm being unfair talking about distros plural: I'm mainly thinking of how the latest Ubuntu has disabled unprivileged user namespaces by default [0], seeing them as too big an attack surface to let everything use them. It looks like Debian used to have them disabled, but then re-enabled them for the sake of web browsers [1]; I'm sure they'd re-disable them if they found some solution similar to Ubuntu's AppArmor one. For other distros, it's difficult to find up-to-date information on whether they enable or disable unprivileged user namespaces, since many have flipped back and forth over the last decade. All that is to say that unless your program is given privileges itself (e.g., Docker), or can wheedle user-namespace permissions out of the packagers, there's no chance you'll be able to distribute namespace-using code and have it work consistently for most users. [0] https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions-15 https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat... [1] https://salsa.debian.org/kernel-team/linux/-/commit/a381917851e762684ebe28e04c5ae0d8be7f42c7 https://salsa.debian.org/kernel-team/linux/-/commit/a3819178...

bduffany 2y ago

What do you mean by unprivileged namespaces being buried by the big-name distros?

happymellon 2y ago
Presumably this, Unprivileged Name Spaces getting blocked by Ubuntu. Not sure if anyone else is doing it. https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged...
- LegionMammal978 2y ago
  It seems that until 2020, Debian used to block them as well [0]. So perhaps some of my perceptions are out of date. In any case, it means namespaces are unreliable to use for the typical Linux program. [0] https://salsa.debian.org/kernel-team/linux/-/commit/a381917851e762684ebe28e04c5ae0d8be7f42c7 https://salsa.debian.org/kernel-team/linux/-/commit/a3819178...
LegionMammal978 2y ago
Well, perhaps I'm being unfair talking about distros plural: I'm mainly thinking of how the latest Ubuntu has disabled unprivileged user namespaces by default [0], seeing them as too big an attack surface to let everything use them. It looks like Debian used to have them disabled, but then re-enabled them for the sake of web browsers [1]; I'm sure they'd re-disable them if they found some solution similar to Ubuntu's AppArmor one. For other distros, it's difficult to find up-to-date information on whether they enable or disable unprivileged user namespaces, since many have flipped back and forth over the last decade. All that is to say that unless your program is given privileges itself (e.g., Docker), or can wheedle user-namespace permissions out of the packagers, there's no chance you'll be able to distribute namespace-using code and have it work consistently for most users. [0] https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions-15 https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat... [1] https://salsa.debian.org/kernel-team/linux/-/commit/a381917851e762684ebe28e04c5ae0d8be7f42c7 https://salsa.debian.org/kernel-team/linux/-/commit/a3819178...