Equivalent of --map-root-user

[douglas-raillard-arm]

Hi,

For some reason on my system unshare -m is not permitted as a regular user unless --map-root-user is also used. Given the general usefulness of --map-root-user, would you consider adding a similar option to unshare.unshare() Python function ?

Regards,
Douglas

[shubham1172]

@douglas-raillard-arm that sounds good, would you like to send in a PR?

[douglas-raillard-arm]

I unfortunately don't have the bandwidth at the moment, I guess I did not really require the feature in the end or found a workaround, I cannot remember. Let's leave it opened so that people understand what happens if they hit the issue, as the kernel is not particularly verbose when something goes wrong

[hexDoor]

I unfortunately don't have the bandwidth at the moment, I guess I did not really require the feature in the end or found a workaround, I cannot remember. Let's leave it opened so that people understand what happens if they hit the issue, as the kernel is not particularly verbose when something goes wrong

Just for anyone who comes by (since I also ran into this issue), I ended up writing the mapping to /proc/self/uid_map, /proc/self/gid_map and /proc/self/setgroups directly.

user_namespaces(7) should have all the information you need to work from there.

[douglas-raillard-arm]

The current state of my code is there and has worked for a while now. It also takes care of spinning up a sub process and transferring logging back to the main process to be as transparent as possible.
https://github.com/ARM-software/lisa/blob/master/lisa/_unshare.py

[hpe-ykoehler]

if I run from the shell "unshare -rm" (which does unshare (NEWNS|NEWUSER)" it works, but whenever I call unshare from python be it with ffi or ctypes or this unshare component, I get invalid error or permission denied.

Somehow it seems that the NEWNS must gets executed after the NEWUSER... when that when I use -rm directly in shell it seems to work, yet the C code of unshare seems to be calling it the same way as in the Python code.

[douglas-raillard-arm]

Maybe you are running in a more restricted environment like a container ? The Python source I shared above has been used by my team for quite a while now and it works well AFAIK on a typical Ubuntu setup.