Re: unshare -m for non-root user

["U.Mutlu" <for-gmane@mutluit.com>]

Eric W. Biederman wrote on 11/14/2015 04:53 AM:
> "U.Mutlu" <for-gmane@mutluit.com> writes:
>
>> Karel Zak wrote on 10/30/2015 11:22 AM:
>>> On Fri, Oct 30, 2015 at 03:09:15AM +0100, U.Mutlu wrote:
>>>> Hi,
>>>> I wonder why "unshare -m" doesn't work for an unpriviledged user:
>>>>
>>>> $ unshare -m /bin/bash
>>>> unshare: unshare failed: Operation not permitted
>>>> $ echo $?
>>>> 1
>>>> $ ls -l `which unshare`
>>>> -rwxr-xr-x 1 root root 14640 Mar 30  2015 /usr/bin/unshare
>>>>
>>>> Funny thing: when making the binary setuid then it works.
>>>> But I would prefer a working original version in the OS repository.
>>>>
>>>> OS: Debian 8
>>>>
>>>> # dpkg -l | grep -i util-linux
>>>> ii  util-linux                                 2.25.2-6            amd64
>>>> Miscellaneous system utilities
>>>>
>>>> Is this a bug, or is it not supposed to work for non-root users?
>>>
>>> man 2 unshare:
>>>
>>> CLONE_NEWNS
>>>
>>> This  flag has the same effect as the clone(2) CLONE_NEWNS flag.
>>> Unshare the mount namespace, so that the calling process has a private
>>> copy of its namespace which is not shared with any other process.
>>> Specifying this flag automatically implies CLONE_FS as well.  Use of
>>> CLONE_NEWNS requires the CAP_SYS_ADMIN capability.
>>>                            ^^^^^^^^^^^^
>>>
>>> .. so yes, it's expected behavior.
>>>
>>>       Karel
>>
>> I would say that the bug lies in the wrong file permissions.
>> chmod u+s fixes the bug, and I suggest that this should be the default.
>> Then non-root users can use it too.
>
> There is no bug.  There are real dangers in creating a new mount
> namespace as you can fool suid root applications like passwd.

Any links to further info on that?

> You can safely use new mount namespaces after creating a new user
> namespace, and that does not require any special permissions on unshare.

Is that creating a new user namespace and therein being root and then using 
unshare?
If yes, then this is not what I need. I need unshare for a non-root user.