Re: unshare -m for non-root user

["U.Mutlu" <for-gmane@mutluit.com>]

Ángel González wrote on 11/15/2015 09:25 PM:
>>> complain to Debian. iirc, they break their kernels on purpose by adding
>>> non-standard caps which disallow userns usage.
>>
>> Ok, I found out that on Debian one needs to make the follwing entry in
>> /etc/sysctl.conf:
>> kernel.unprivileged_userns_clone = 1
>> and reboot, or do sysctl -p /etc/sysctl.conf, or equivalently
>> echo 1 > /proc/sys/kernel/unprivileged_userns_clone
>
> The kernel will neded to be compiled with CONFIG_USER_NS

True, but the stock Debian 8 kernel has it already enabled,
as the following tool (belongs to lxc) reports:

#######
$ lxc-checkconfig
Kernel configuration not found at /proc/config.gz; searching...
Kernel configuration found at /boot/config-3.16.0-4-amd64
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
Network namespace: enabled
Multiple /dev/pts instances: enabled

--- Control groups ---
Cgroup: enabled
Cgroup clone_children flag: enabled
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
File capabilities: enabled

Note : Before booting a new kernel, you can check its configuration
usage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig
#######

Another method to see it is this one:
$ grep CONFIG_USER_NS /boot/config-`uname -r`
CONFIG_USER_NS=y