Re: unshare -m for non-root user

["U.Mutlu" <for-gmane@mutluit.com>]

Karel Zak wrote on 10/30/2015 11:22 AM:
> On Fri, Oct 30, 2015 at 03:09:15AM +0100, U.Mutlu wrote:
>> Hi,
>> I wonder why "unshare -m" doesn't work for an unpriviledged user:
>>
>> $ unshare -m /bin/bash
>> unshare: unshare failed: Operation not permitted
>> $ echo $?
>> 1
>> $ ls -l `which unshare`
>> -rwxr-xr-x 1 root root 14640 Mar 30  2015 /usr/bin/unshare
>>
>> Funny thing: when making the binary setuid then it works.
>> But I would prefer a working original version in the OS repository.
>>
>> OS: Debian 8
>>
>> # dpkg -l | grep -i util-linux
>> ii  util-linux                                 2.25.2-6            amd64
>> Miscellaneous system utilities
>>
>> Is this a bug, or is it not supposed to work for non-root users?
>
> man 2 unshare:
>
> CLONE_NEWNS
>
> This  flag has the same effect as the clone(2) CLONE_NEWNS flag.
> Unshare the mount namespace, so that the calling process has a private
> copy of its namespace which is not shared with any other process.
> Specifying this flag automatically implies CLONE_FS as well.  Use of
> CLONE_NEWNS requires the CAP_SYS_ADMIN capability.
>                           ^^^^^^^^^^^^
>
> .. so yes, it's expected behavior.
>
>      Karel

I would say that the bug lies in the wrong file permissions.
chmod u+s fixes the bug, and I suggest that this should be the default.
Then non-root users can use it too.