ceamac/slocker-lite
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Combine namespace probes with CLONE_NEWUSER

Browse Source 
As a regular (non-root) user, most namespace types can only be
unshared together with a fresh user namespace, not in isolation --
the user namespace is what supplies the needed capabilities. Probing
each type on its own under-reported support: on this dev machine only
--unshare-user came back as supported, when in fact ipc/pid/net/uts/
cgroup were all usable once combined with it.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Viorel Munteanu
2026-08-17 09:07:29 +00:00
parent 4478e94b65
commit 529a96c89c
1 changed files with 17 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/bwrap.cpp
+17 -1
View File
@@ -113,13 +113,29 @@ std::optional<pid_t> find_fuse_overlayfs_pid(const std::string& merged_path) {
std::vector<std::string> detect_bwrap_unshare_args() {
std::vector<std::string> args;
bool user_ns_supported = kernel_supports_namespace(CLONE_NEWUSER);
spdlog::debug("namespace user: {}", user_ns_supported ? "supported" : "not supported");
if (user_ns_supported) {
args.push_back("--unshare-user");
}
for (const auto& probe : kNamespaceProbes) {
bool supported = kernel_supports_namespace(probe.clone_flag);
if (probe.clone_flag == CLONE_NEWUSER) {
continue;
}
// As a regular (non-root) user, most namespace types can only be unshared
// together with a fresh user namespace (which supplies the capabilities
// needed), not in isolation -- so combine them here whenever the user
// namespace probe above succeeded.
int flags = probe.clone_flag | (user_ns_supported ? CLONE_NEWUSER : 0);
bool supported = kernel_supports_namespace(flags);
spdlog::debug("namespace {}: {}", probe.name, supported ? "supported" : "not supported");
if (supported) {
args.push_back(probe.bwrap_arg);
}
}
return args;
}