Re: Building a BSD-jail clone out of namespaces

[ebiederm@xmission.com (Eric W. Biederman)]

Chris Webb <chris@arachsys.com> writes:

> "Eric W. Biederman" <ebiederm@xmission.com> writes:
>
>> That will work, but you really don't want to run with uid == 0 mapped to
>> uid == 0.  There are too many things in /proc and /sys and similar that
>> grant access to uid == 0.
>
> Many thanks for the swift reply. If I map UID zero in the userns to a
> non-zero UID outside (say -1), is there any way to use the userns UIDs
> instead of host UIDs when accessing the container's root filesystem so I
> don't end up with strange file ownerships on disk? This would prevent me
> from using the same filesystem on physical hosts or in VMs.

Hmm.  I guess it depends on how your VM is reading them.  If it is
blocked based access to the filesystem you have a problem.   If the VM
is effectively NFS mounting the filesystem you can do all kinds of
things.

It is possible to just change the user namespace and setup your mapping,
effectively running your VM in the user namespace, and that would allow
the VM to see your mapped uids.

> I don't think there's any kernel mechanism that lets me apply a UID
> translation layer as part of a bind mount is there?

No.  In principle you could mount the filesystem inside of the user
namespace but in practice no filesystems support that yet.

Eric