diff options
author | Mike Frysinger | 2013-06-28 02:04:58 +0200 |
---|---|---|
committer | Karel Zak | 2013-07-09 11:02:16 +0200 |
commit | 5088ec338fe5dcd7e9a2d8daf7e7fa7dd6f87c27 (patch) | |
tree | 7dc914c23a62e7ffd07444db02474f1e58c6bb39 /sys-utils/unshare.1 | |
parent | include/xalloc: add warn_unused_result to allocation functions (diff) | |
download | kernel-qcow2-util-linux-5088ec338fe5dcd7e9a2d8daf7e7fa7dd6f87c27.tar.gz kernel-qcow2-util-linux-5088ec338fe5dcd7e9a2d8daf7e7fa7dd6f87c27.tar.xz kernel-qcow2-util-linux-5088ec338fe5dcd7e9a2d8daf7e7fa7dd6f87c27.zip |
unshare: add --fork options for pid namespaces
The ability of unshare to launch a new pid namespace is a bit limited.
The first process in the namespace is expected to be the "init" for it.
When it's not, you get bad behavior.
For example, trying to launch a shell in a new pid namespace fails very
quickly:
$ sudo unshare -p dash
# uname -r
3.8.3
# uname -m
dash: 2: Cannot fork
# ls -ld /
dash: 3: Cannot fork
# echo $$
1324
For this to work smoothly, we need an init process to actively watch over
things. But forcing people to re-use an existing init or write their own
mini init is a bit overkill. So let's add a --fork option to unshare to
do this common bit of book keeping. Now we can do:
$ sudo unshare -p --fork dash
# uname -r
3.8.3
# uname -m
x86_64
# ls -ld /
drwxr-xr-x 22 root root 4096 May 4 14:01 /
# echo $$
1
Thanks to Michael Kerrisk for his namespace articles on lwn.net
[kzak@redhat.com: - fix "forkif logic, remove --mount-proc]
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Karel Zak <kzak@redhat.com>
Diffstat (limited to 'sys-utils/unshare.1')
-rw-r--r-- | sys-utils/unshare.1 | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/sys-utils/unshare.1 b/sys-utils/unshare.1 index bd0f13eb5..c387cebfd 100644 --- a/sys-utils/unshare.1 +++ b/sys-utils/unshare.1 @@ -56,13 +56,17 @@ Unshare the mount namespace. Unshare the network namespace. .TP .BR \-p , " \-\-pid" -Unshare the pid namespace. +Unshare the pid namespace. See also \fB--fork\fP option. .TP .BR \-u , " \-\-uts" Unshare the UTS namespace. .TP .BR \-U , " \-\-user" Unshare the user namespace. +.TP +.BR \-f , " \-\-fork" +Fork the specified process as a child of unshare rather than running it +directly. This is useful when creating a new pid namespace. .SH SEE ALSO .BR unshare (2), .BR clone (2) |