1

I'm trying to create a process with its own namespace and then make a uid (and possibly gid) mapping. I'm following this question with this answer, but, as indicated in this recent comment, it no longer works.

Here's the skinny. First, you create a process in a new namespace with unshare:

unshare -U bash

And obtain the process it runs, with echo $$ or somesuch. You grab that PID and then, from another shell, you go:

newuidmap 12394 0 0 1

The answer, as indicated in the comment above, is:

newuidmap: uid range [0-1) -> [0-1) not allowed

In an update to the answer, Arks mentions:

it is something with settings in /etc/subuid and /etc/subguid files

I can't figure out, however, what they mean. Any idea?

jjmerelo
  • 22,578
  • 8
  • 40
  • 86

1 Answers1

1

Still don't understand why newuidmap does not work. But this article shows that writing to /proc/$$/uid_map does 

echo '5 1000 1' > /proc/14671/uid_map

This is an one-time operation that can't be repeated, and in a single command, establishes the mapping for UIDs and GIDs.

jjmerelo
  • 22,578
  • 8
  • 40
  • 86