summaryrefslogtreecommitdiffstats
path: root/sys-utils/unshare.c
Commit message (Collapse)AuthorAgeFilesLines
* unshare: add --mount-proc for pid namespacesKarel Zak2013-07-091-7/+23
| | | | | | | | | | | | | | | Based on patch from Mike Frysinger <vapier@gentoo.org>. Mike Frysinger wrote: When it comes to pid namespaces, it's also useful for /proc to reflect the current namespace. Again, this is easy to pull off, but annoying to force everyone to do it themselves. So let's add a --mount-proc to do the magic for us. The downside is that this also implies creating a mount namespace as mounting the new pid namespace /proc over top the system one will quickly break all other processes on the system. Signed-off-by: Karel Zak <kzak@redhat.com> Acked-by: Mike Frysinger <vapier@gentoo.or>
* unshare: add --fork options for pid namespacesMike Frysinger2013-07-091-3/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The ability of unshare to launch a new pid namespace is a bit limited. The first process in the namespace is expected to be the "init" for it. When it's not, you get bad behavior. For example, trying to launch a shell in a new pid namespace fails very quickly: $ sudo unshare -p dash # uname -r 3.8.3 # uname -m dash: 2: Cannot fork # ls -ld / dash: 3: Cannot fork # echo $$ 1324 For this to work smoothly, we need an init process to actively watch over things. But forcing people to re-use an existing init or write their own mini init is a bit overkill. So let's add a --fork option to unshare to do this common bit of book keeping. Now we can do: $ sudo unshare -p --fork dash # uname -r 3.8.3 # uname -m x86_64 # ls -ld / drwxr-xr-x 22 root root 4096 May 4 14:01 / # echo $$ 1 Thanks to Michael Kerrisk for his namespace articles on lwn.net [kzak@redhat.com: - fix "forkif logic, remove --mount-proc] Signed-off-by: Mike Frysinger <vapier@gentoo.org> Signed-off-by: Karel Zak <kzak@redhat.com>
* unshare: tweak styleMike Frysinger2013-03-041-3/+3
| | | | Signed-off-by: Mike Frysinger <vapier@gentoo.org>
* unshare,nsenter: spawn shell by defaultZbigniew Jędrzejewski-Szmek2013-02-141-6/+6
| | | | | | | | | | | | | The behaviour mimics chroot. Possibly it would have been nicer to to query the password database in the new namepace and run the shell of the user there, but it's hard to do correctly. getpwuid() might need to load nss plugins, and the arch in the new namespace might be different (in case of NEWNS mounts), or the hostname might be different, etc. So in general it's not possible to do it reliably. Signed-off-by: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>
* translation: unify exec error messagesSami Kerola2013-02-061-1/+1
| | | | Signed-off-by: Sami Kerola <kerolasa@iki.fi>
* unshare: make usage() translator friendlySami Kerola2013-01-251-6/+6
| | | | Signed-off-by: Sami Kerola <kerolasa@iki.fi>
* unshare,nsenter: Move the old libc handling into a common header namespace.hEric W. Biederman2013-01-171-28/+1Star
| | | | | | | | | | | | | | Move the defitions of CLONE_NEWNS, CLONE_NEWUTS, CLONE_NEWIPC, CLONE_NEWNET, CLONE_NEWUSER, CLONE_NEWPID into namespace.h in case sched.h does not provide those definitions. Are there systems around that are old enough that still need this? Move the definitions of unshare() and setns() into namespace.h for supporting old versions of libc that does not provice these. I have tested this support with setns as I still have systems old enough that glibc does not wrap setns. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
* unshare: Add support for the pid and user namespacesEric W. Biederman2013-01-171-9/+18
| | | | | | | | | | | | - Update the unshare application to support the pid and user namespaces. - Update the man page for the new options - Fix typo in the man page where UTS was spelled UTC. - Remove the vestigal support for running a suid unshare. After unsharing a user namespace setuid(getuid()) won't work because no uid or gid mappings have been specified yet. So it is just easier not to have any support for running suid. Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
* Revert "unshare: support the switching of namespaces"Karel Zak2013-01-171-58/+17Star
| | | | | | | The functionality will be replaced with nsenter from Eric W. Biederman. This reverts commit 4bbe8099390d528018890efa914e268de3c4b44b.
* unshare: support the switching of namespacesNeil Horman2013-01-071-17/+58
| | | | | | | | | | | | | | | | | | | | | In addition to the unshare syscall, there exists the setns syscall, which allows processes to migrate to the namepsaces of other processes. Add this functionality into the unshare command, as they operate in a fairly simmilar fashion. Note: There was discussion of adding a path based namespace argument to unshare in the origional discussion thread, but I opted to leave that out as it didn't seem to fit in nicely with the current argument pattern. I figure we can always add that in later if we need to [kzak@redhat.com: - fix optional arguments - do not call unshare if no flag specified - use O_CLOEXEC - codding style cleanup] Signed-off-by: Neil Horman <nhorman@tuxdriver.com> CC: Karel Zak <kzak@redhat.com> Signed-off-by: Karel Zak <kzak@redhat.com>
* sys-utils: verify writing to streams was successfulSami Kerola2012-04-041-0/+2
| | | | Signed-off-by: Sami Kerola <kerolasa@iki.fi>
* docs: corrections to FSF license files, and postal addressSami Kerola2012-02-241-1/+1
| | | | | | | | | | | | | | The COPYING and Documentation/licenses/COPYING* files are being replaced by files from GNU web site. http://www.gnu.org/licenses/gpl-2.0.txt http://www.gnu.org/licenses/lgpl-2.1.txt Postal addresses to FSF in other files are updated to match with the address in license files. Reference: http://lists.gnu.org/archive/html/freefont-announce/2005-04/msg00001.html Signed-off-by: Sami Kerola <kerolasa@iki.fi>
* unshare: align with howto-usage-function.txtSami Kerola2011-10-301-6/+13
| | | | Signed-off-by: Sami Kerola <kerolasa@iki.fi>
* unshare: cleanup usage()Karel Zak2011-08-161-11/+12
| | | | Signed-off-by: Karel Zak <kzak@redhat.com>
* move struct option to .rodataKarel Zak2011-03-031-1/+1
| | | | | | | It does not make sense to have writable large arrays of "struct option" on the stack. Signed-off-by: Karel Zak <kzak@redhat.com>
* build-sys: provide alternatives for err, errx, warn and warnxFabian Groffen2011-02-141-1/+1
| | | | | | | | Solaris lacks err, errx, warn and warnx. This also means the err.h header doesn't exist. Removed err.h include from all files, and included err.h from c.h instead if it exists, otherwise alternatives are provided. Signed-off-by: Fabian Groffen <grobian@gentoo.org>
* unshare: fix SIGSEGV on invalid command line optionAlexey Gladkov2011-01-051-0/+1
| | | | | | | | | $ unshare --hel Segmentation fault The last element of longopts has to be filled with zeros. Signed-off-by: Kirill A. Shutemov <kirill@shutemov.name>
* unshare: drop potential euid privileges before execKarel Zak2010-05-061-0/+7
| | | | | | | | | | | This patch drops potential euid privileges before executing the target program. This allows to setuid unshare. The unshare(1) is still distributed as non-setuid program. Based on patch from Martin Pohlack <mp26@os.inf.tu-dresden.de>. Signed-off-by: Karel Zak <kzak@redhat.com>
* unshare: new commandMikhail Gusarov2009-10-061-0/+119
New utility allows to run process with separate mount, UTC, IPC or network namespaces. [kzak@redhat.com: - some cosmetic changes in usage() and err() usage - move "if BUILD_UNSHARE" to separate place in Makefile.am - add unshare to .gitignore] Signed-off-by: Mikhail Gusarov <dottedmag@dottedmag.net> Signed-off-by: Karel Zak <kzak@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2024-06-30 01:33:09 +0200