Subject: [alpine-devel] uuns: Unprivileged user namespaces on hardened kernel

From: Steven McDonald <[email-masked]>
Date: Mon, 22 May 2017 14:07:41 +0200

Hi there,

I've been playing around with unprivileged user namespaces on Alpine
and decided to write a simple tool to make them feasible (without
installing LXC) on Alpine's hardened kernel.

I've just pushed it to GitHub:

  https://github.com/stevenjm/uuns

It's essentially the same thing as "unshare --user", but the executable
has the file capabilities necessary to create user namespaces, and has
execution restricted to a "uuns" group. This provides an easy way for
the administrator to control permissions for creating unprivileged
namespaces; simply add users to the "uuns" group.

I'm interested in feedback. If this is something of interest to the
distribution, I'll try my hand at creating a package for it.

--
Steven

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: 7heo <[email-masked]>
Date: Mon, 22 May 2017 13:19:59 +0000

I like its simplicity and default behavior to start a shell.

I am not very familiar with namespaces myself, but this looks like a good idea.

I'll try it when I have time.

Cheers,
Theo. 

On Monday, May 22, 2017, Steven McDonald wrote:
>�˛���m楦)�u�ޗ맲��r��zX��ƥ�)ޖ)�Ɗ��ijZb��^��~��i�+-��i�w��{���

---

From: Steven McDonald <[email-masked]>
Date: Sun, 28 May 2017 04:32:55 +0200

On Mon, 22 May 2017 13:19:59 +0000

> I'll try it when I have time.

Thanks for the feedback.

After some more experimentation, I think this is actually not very
useful. The same thing can be accomplished by simply creating the
namespace as root and then mapping a different user to root inside the
namespace. The documentation had initially lead me to believe otherwise.

I'll leave this up on GitHub in case somebody else has a use for it, but
I probably won't be doing anything else with it myself.

---