man7/namespaces.7

   1 .\" Copyright (c) 2013 by Michael Kerrisk <mtk.manpages@gmail.com>
   2 .\" and Copyright (c) 2012 by Eric W. Biederman <ebiederm@xmission.com>
   3 .\"
   4 .\" Permission is granted to make and distribute verbatim copies of this
   5 .\" manual provided the copyright notice and this permission notice are
   6 .\" preserved on all copies.
   7 .\"
   8 .\" Permission is granted to copy and distribute modified versions of this
   9 .\" manual under the conditions for verbatim copying, provided that the
  10 .\" entire resulting derived work is distributed under the terms of a
  11 .\" permission notice identical to this one.
  12 .\"
  13 .\" Since the Linux kernel and libraries are constantly changing, this
  14 .\" manual page may be incorrect or out-of-date.  The author(s) assume no
  15 .\" responsibility for errors or omissions, or for damages resulting from
  16 .\" the use of the information contained herein.  The author(s) may not
  17 .\" have taken the same level of care in the production of this manual,
  18 .\" which is licensed free of charge, as they might when working
  19 .\" professionally.
  20 .\"
  21 .\" Formatted or processed versions of this manual, if unaccompanied by
  22 .\" the source, must acknowledge the copyright and authors of this work.
  23 .\"
  24 .\"
  25 .TH NAMESPACES 7 2013-01-14 "Linux" "Linux Programmer's Manual"
  26 .SH NAME
  27 namespaces \- overview of Linux namespaces
  28 .SH DESCRIPTION
  29 A namespace wraps a global system resource in an abstraction that
  30 makes it appear to the processes within the namespace that they
  31 have their own isolated instance of the global resource.
  32 Changes to the global resource are visible to other processes
  33 that are members of the namespace, but are invisible to other processes.
  34 One use of namespaces is to implement containers.
  35
  36 This page describes the various namespaces and the associated
  37 .I /proc
  38 files, and summarizes the APIs for working with namespaces.
  39 .\"
  40 .\" ==================== The namespaces API ====================
  41 .\"
  42 .SS The namespaces API
  43 As well as various
  44 .I /proc
  45 files described below,
  46 the namespaces API includes the following system calls:
  47 .TP
  48 .BR clone (2)
  49 The
  50 .BR clone (2)
  51 system call creates a new process.
  52 If the
  53 .I flags
  54 argument of the call specifies one or more of the
  55 .B CLONE_NEW*
  56 flags listed below, then new namespaces are created for each flag,
  57 and the child process is made a member of those namespaces.
  58 (This system call also implements a number of features
  59 unrelated to namespaces.)
  60 .TP
  61 .BR setns (2)
  62 The
  63 .BR setns (2)
  64 system call allows the calling process to join an existing namespace.
  65 The namespace to join is specified via a file descriptor that refers to
  66 one of the
  67 .IR /proc/[pid]/ns
  68 files described below.
  69 .TP
  70 .BR unshare (2)
  71 The
  72 .BR unshare (2)
  73 system call moves the calling process to a new namespace.
  74 If the
  75 .I flags
  76 argument of the call specifies one or more of the
  77 .B CLONE_NEW*
  78 flags listed below, then new namespaces are created for each flag,
  79 and the calling process is made a member of those namespaces.
  80 (This system call also implements a number of features
  81 unrelated to namespaces.)
  82 .PP
  83 Creation of new namespaces using
  84 .BR clone (2)
  85 and
  86 .BR unshare (2)
  87 in most cases requires the
  88 .BR CAP_SYS_ADMIN
  89 capability.
  90 User namespaces are the exception: since Linux 3.8,
  91 no privilege is required to create a user namespace.
  92 .\"
  93 .\" ==================== The /proc/[pid]/ns/ directory ====================
  94 .\"
  95 .SS The /proc/[pid]/ns/ directory
  96 Each process has a
  97 .IR /proc/[pid]/ns/
  98 .\" See commit 6b4e306aa3dc94a0545eb9279475b1ab6209a31f
  99 subdirectory containing one entry for each namespace that
 100 supports being manipulated by
 101 .BR setns (2):
 102
 103 .in +4n
 104 .nf
 105 $ \fBls -l /proc/$$/ns\fP
 106 total 0
 107 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 ipc -> ipc:[4026531839]
 108 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 mnt -> mnt:[4026531840]
 109 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 net -> net:[4026531956]
 110 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 pid -> pid:[4026531836]
 111 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 user -> user:[4026531837]
 112 lrwxrwxrwx. 1 mtk mtk 0 Jan 14 01:20 uts -> uts:[4026531838]
 113 .fi
 114 .in
 115
 116 Bind mounting (see
 117 .BR mount (2))
 118 one of the files in this directory
 119 to somewhere else in the file system keeps
 120 the corresponding namespace of the process specified by
 121 .I pid
 122 alive even if all processes currently in the namespace terminate.
 123
 124 Opening one of the files in this directory
 125 (or a file that is bind mounted to one of these files)
 126 returns a file handle for
 127 the corresponding namespace of the process specified by
 128 .IR pid .
 129 As long as this file descriptor remains open,
 130 the namespace will remain alive,
 131 even if all processes in the namespace terminate.
 132 The file descriptor can be passed to
 133 .BR setns (2).
 134
 135 In Linux 3.7 and earlier, these files were visible as hard links.
 136 Since Linux 3.8, they appear as symbolic links.
 137 If two processes are in the same namespace, then the inode numbers of their
 138 .IR /proc/[pid]/ns/xxx
 139 symbolic links will be the same; an application can check this using the
 140 .I stat.st_ino
 141 field returned by
 142 .BR stat (2).
 143 The content of this symbolic link is a string containing
 144 the namespace type and inode number as in the following example:
 145
 146 .in +4n
 147 .nf
 148 $ \fBreadlink /proc/$$/ns/uts\fP
 149 uts:[4026531838]
 150 .fi
 151 .in
 152
 153 The files in this subdirectory are as follows:
 154 .TP
 155 .IR /proc/[pid]/ns/ipc " (since Linux 3.0)"
 156 This file is a handle for the IPC namespace of the process.
 157 .TP
 158 .IR /proc/[pid]/ns/mnt " (since Linux 3.8)"
 159 This file is a handle for the mount namespace of the process.
 160 .TP
 161 .IR /proc/[pid]/ns/net " (since Linux 3.0)"
 162 This file is a handle for the network namespace of the process.
 163 .TP
 164 .IR /proc/[pid]/ns/pid " (since Linux 3.8)"
 165 This file is a handle for the PID namespace of the process.
 166 .TP
 167 .IR /proc/[pid]/ns/user " (since Linux 3.8)"
 168 This file is a handle for the user namespace of the process.
 169 .TP
 170 .IR /proc/[pid]/ns/uts " (since Linux 3.0)"
 171 This file is a handle for the IPC namespace of the process.
 172 .\"
 173 .\" ==================== IPC namespaces ====================
 174 .\"
 175 .SS IPC namespaces (CLONE_NEWIPC)
 176 IPC namespaces isolate certain IPC resources,
 177 namely, System V IPC objects (see
 178 .BR svipc (7))
 179 and (since Linux 2.6.30)
 180 .\" commit 7eafd7c74c3f2e67c27621b987b28397110d643f
 181 .\" https://lwn.net/Articles/312232/
 182 POSIX message queues (see
 183 .BR mq_overview (7).
 184 The common characteristic of these IPC mechanisms is that IPC
 185 objects are identified by mechanisms other than file system
 186 pathnames.
 187
 188 Each IPC namespace has its own set of System V IPC identifiers and
 189 its own POSIX message queue file system.
 190 Objects created in an IPC namespace are visible to all other processes
 191 that are members of that namespace,
 192 but are not visible to processes in other IPC namespaces.
 193
 194 When an IPC namespace is destroyed
 195 (i.e., when the last process that is a member of the namespace terminates),
 196 all IPC objects in the namespace are automatically destroyed.
 197
 198 Use of IPC namespaces requires a kernel that is configured with the
 199 .B CONFIG_IPC_NS
 200 option.
 201 .\"
 202 .\" ==================== Network namespaces ====================
 203 .\"
 204 .SS Network namespaces (CLONE_NEWNET)
 205 Network namespaces provide isolation of the system resources associated
 206 with networking: network devices, IP addresses, IP routing tables,
 207 .I /proc/net
 208 directory,
 209 .I /sys/class/net
 210 directory, port numbers, and so on.
 211
 212 A network namespace provides an isolated view of the networking stack
 213 (network device interfaces, IPv4 and IPv6 protocol stacks,
 214 IP routing tables, firewall rules, the
 215 .I /proc/net
 216 and
 217 .I /sys/class/net
 218 directory trees, sockets, etc.).
 219 A physical network device can live in exactly one
 220 network namespace.
 221 A virtual network device ("veth") pair provides a pipe-like abstraction
 222 .\" FIXME Add pointer to veth(4) page when it is eventually completed
 223 that can be used to create tunnels between network namespaces,
 224 and can be used to create a bridge to a physical network device
 225 in another namespace.
 226
 227 When a network namespace is freed
 228 (i.e., when the last process in the namespace terminates),
 229 its physical network devices are moved back to the
 230 initial network namespace (not to the parent of the process).
 231
 232 Use of network namespaces requires a kernel that is configured with the
 233 .B CONFIG_NET_NS
 234 option.
 235 .\"
 236 .\" ==================== Mount namespaces ====================
 237 .\"
 238 .SS Mount namespaces (CLONE_NEWNS)
 239 Mount namespaces isolate the set of file system mount points,
 240 meaning that processes in different mount namespaces can
 241 have different views of the file system hierarchy.
 242 The set of mounts in a mount namespace is modified using
 243 .BR mount (2)
 244 and
 245 .BR umount (2).
 246
 247 The
 248 .IR /proc/[pid]/mounts
 249 file (present since Linux 2.4.19)
 250 lists all the file systems currently mounted in the
 251 process's mount namespace.
 252 The format of this file is documented in
 253 .BR fstab (5).
 254 Since kernel version 2.6.15, this file is pollable:
 255 after opening the file for reading, a change in this file
 256 (i.e., a file system mount or unmount) causes
 257 .BR select (2)
 258 to mark the file descriptor as readable, and
 259 .BR poll (2)
 260 and
 261 .BR epoll_wait (2)
 262 mark the file as having an error condition.
 263
 264 The
 265 .IR /proc/[pid]/mountstats
 266 file (present since Linux 2.6.17)
 267 exports information (statistics, configuration information)
 268 about the mount points in the process's mount namespace.
 269 This file is only readable by the owner of the process.
 270 Lines in this file have the form:
 271 .RS
 272 .in 12
 273 .nf
 274
 275 device /dev/sda7 mounted on /home with fstype ext3 [statistics]
 276 (       1      )            ( 2 )             (3 ) (4)
 277 .fi
 278 .in
 279
 280 The fields in each line are:
 281 .TP 5
 282 (1)
 283 The name of the mounted device
 284 (or "nodevice" if there is no corresponding device).
 285 .TP
 286 (2)
 287 The mount point within the file system tree.
 288 .TP
 289 (3)
 290 The file system type.
 291 .TP
 292 (4)
 293 Optional statistics and configuration information.
 294 Currently (as at Linux 2.6.26), only NFS file systems export
 295 information via this field.
 296 .RE
 297 .\"
 298 .\" ==================== PID namespaces ====================
 299 .\"
 300 .SS PID namespaces (CLONE_NEWPID)
 301 PID namespaces isolate the process ID number space,
 302 meaning that processes in different PID namespaces can have the same PID.
 303 PID namespaces allow containers to migrate to a new host
 304 while the processes inside the container maintain the same PIDs.
 305
 306 PIDs in a new PID namespace start at 1,
 307 somewhat like a standalone system, and calls to
 308 .BR fork (2),
 309 .BR vfork (2),
 310 or
 311 .BR clone (2)
 312 will produce processes with PIDs that are unique within the namespace.
 313
 314 The first process created in a new namespace
 315 (i.e., the process created using
 316 .BR clone (2)
 317 with the
 318 .BR CLONE_NEWPID
 319 flag, or the first child created by a process after a call to
 320 .BR unshare (2)
 321 using the
 322 .BR CLONE_NEWPID
 323 flag) has the PID 1, and is the "init" process for the namespace (see
 324 .BR init (1)).
 325 Children that are orphaned within the namespace will be reparented
 326 to this process rather than
 327 .BR init (1).
 328
 329 If the "init" process of a PID namespace terminates,
 330 the kernel terminates all of the processes in the namespace via a
 331 .BR SIGKILL
 332 signal.
 333 This behavior reflects the fact that the "init" process
 334 is essential for the correct operation of a PID namespace.
 335 In this case, a subsequent
 336 .BR fork (2)
 337 into this PID namespace (e.g., from a process that has done a
 338 .BR setns (2)
 339 into the namespace using an open file descriptor for a
 340 .I /proc/[pid]/ns/pid
 341 file corresponding to a process that was in the namespace)
 342 will fail with the error
 343 .BR ENOMEM ;
 344 it is not possible to create a new processes in a PID namespace whose "init"
 345 process has terminated.
 346
 347 Only signals for which the "init" process has established a signal handler
 348 can be sent to the "init" process by other members of the PID namespace.
 349 This restriction applies even to privileged processes,
 350 and prevents other members of the PID namespace from
 351 accidentally killing the "init" process.
 352
 353 Likewise, a process in an ancestor namespace
 354 can\(emsubject to the usual permission checks described in
 355 .BR kill (2)\(emsend
 356 signals to the "init" process of a child PID namespace only
 357 if the "init" process has established a handler for that signal.
 358 (Within the handler, the
 359 .I siginfo_t
 360 .I si_pid
 361 field described in
 362 .BR sigaction (2)
 363 will be zero.)
 364 .B SIGKILL
 365 or
 366 .B SIGSTOP
 367 are treated exceptionally:
 368 these signals are forcibly delivered when sent from an ancestor PID namespace.
 369 Neither of these signals can be caught by the "init" process,
 370 and so will result in the usual actions associated with those signals
 371 (respectively, terminating and stopping the process).
 372
 373 PID namespaces can be nested.
 374 When a new PID namespace is created,
 375 the processes in that namespace are visible
 376 in the PID namespace of the process that created the new namespace;
 377 analogously, if the parent PID namespace is itself
 378 the child of another PID namespace,
 379 then processes in the child and parent PID namespaces will both be
 380 visible in the grandparent PID namespace.
 381 Conversely, the processes in the "child" PID namespace do not see
 382 the processes in the parent namespace.
 383 More succinctly: a process can see (e.g., send signals with
 384 .BR kill(2))
 385 only processes contained in its own PID namespace
 386 and the namespaces nested below that PID namespace.
 387
 388 A process will have one PID for each of the layers of the hierarchy
 389 starting from the PID namespace in which it resides
 390 through to the root PID namespace.
 391 A call to
 392 .BR getpid (2)
 393 always returns the PID associated with the namespace in which
 394 the process resides.
 395
 396 Some processes in a PID namespace may have parents
 397 that are outside of the namespace.
 398 For example, the parent of the initial process in the namespace
 399 (i.e.,
 400 the
 401 .BR init (1)
 402 process with PID 1) is necessarily in another namespace.
 403 Likewise, the direct children of a process that uses
 404 .BR setns (2)
 405 to cause its children to join a PID namespace are in a different
 406 PID namespace from the caller of
 407 .BR setns (2).
 408 Calls to
 409 .BR getppid (2)
 410 for such processes return 0.
 411
 412 After creating a new PID namespace,
 413 it is useful for the child to change its root directory
 414 and mount a new procfs instance at
 415 .I /proc
 416 so that tools such as
 417 .BR ps (1)
 418 work correctly.
 419 .\" mount -t proc proc /proc
 420 (If
 421 .BR CLONE_NEWNS
 422 is also included in the
 423 .IR flags
 424 argument of
 425 .BR clone (2)
 426 or
 427 .BR unshare (2)),
 428 then it isn't necessary to change the root directory:
 429 a new procfs instance can be mounted directly over
 430 .IR /proc .)
 431
 432 Calls to
 433 .BR setns (2)
 434 that specify a PID namespace file descriptor
 435 and calls to
 436 .BR unshare (2)
 437 with the
 438 .BR CLONE_NEWPID
 439 flag cause children subsequently created
 440 by the caller to be placed in a different PID namespace from the caller.
 441 These calls do not, however,
 442 change the PID namespace of the calling process,
 443 because doing so would change the caller's idea of its own PID
 444 (as reported by
 445 .BR getpid ()),
 446 which would break many applications and libraries.
 447 To put things another way:
 448 a process's PID namespace membership is determined when the process is created
 449 and cannot be changed thereafter.
 450
 451 Every thread in a process must be in the same PID namespace.
 452 For this reason, the two following call sequences will fail:
 453
 454 .in +4n
 455 .nf
 456     unshare(CLONE_NEWPID);
 457     clone(..., CLONE_VM, ...);    /* Fails */
 458
 459     setns(fd, CLONE_NEWPID);
 460     clone(..., CLONE_VM, ...);    /* Fails */
 461 .fi
 462 .in
 463
 464 Because the above
 465 .BR unshare (2)
 466 and
 467 .BR setns (2)
 468 calls only change the PID namespace for created children, the
 469 .BR clone (2)
 470 calls necessarily put the new thread in a different PID namespace from
 471 the calling thread.
 472
 473 When a process ID is passed over a UNIX domain socket to a
 474 process in a different PID namespace (see the description of
 475 .B SCM_CREDENTIALS
 476 in
 477 .BR unix (7)),
 478 it is translated into the corresponding PID value in
 479 the receiving process's PID namespace.
 480 .\" FIXME Presumably, a similar thing happens with the UID and GID passed
 481 .\" via a UNIX domain socket. That needs to be confirmed and documented
 482 .\" under the "User namespaces" section.
 483
 484 Use of PID namespaces requires a kernel that is configured with the
 485 .B CONFIG_PID_NS
 486 option.
 487 .\"
 488 .\" ==================== User namespaces ====================
 489 .\"
 490 .SS User namespaces (CLONE_NEWUSER)
 491 User namespaces isolate security-related identifiers, in particular,
 492 user IDs, group IDs, keys (see
 493 .BR keyctl (2)),
 494 and capabilities.
 495 A process's user and group IDs can be different
 496 inside and outside a user namespace.
 497 In particular,
 498 a process can have a normal unprivileged user ID outside a user namespace
 499 while at the same time having a user ID of 0 inside the namespace;
 500 in other words,
 501 the process has full privileges for operations inside the user namespace,
 502 but is unprivileged for operations outside the namespace.
 503
 504 User namespaces can be nested;
 505 that is, each user namespace has a parent user namespace,
 506 and can have zero or more child user namespaces.
 507 The parent of a user namespace is the user namespace
 508 of the process that creates the user namespace via a call to
 509 .BR unshare (2)
 510 or
 511 .BR clone (2)
 512 with the
 513 .BR CLONE_NEWUSER
 514 flag.
 515
 516 When a user namespace is created,
 517 it starts out without a mapping of user IDs (group IDs)
 518 to the parent user namespace.
 519 The desired mapping of user IDs (group IDs) to the parent user namespace
 520 may be set by writing into
 521 .IR /proc/[pid]/uid_map
 522 .RI ( /proc/[pid]/gid_map );
 523 see below.
 524
 525 The first process in a user namespace starts out with a complete set
 526 of capabilities with respect to the new user namespace.
 527
 528 System calls that return user IDs (group IDs) will return
 529 either the user ID (group ID) mapped into the current
 530 user namespace if there is a mapping, or the overflow user ID (group ID);
 531 the default value for the overflow user ID (group ID) is 65534.
 532 See the descriptions of
 533 .IR /proc/sys/kernel/overflowuid
 534 and
 535 .IR /proc/sys/kernel/overflowgid
 536 in
 537 .BR proc (5).
 538
 539 Starting in Linux 3.8, unprivileged processes can create user namespaces,
 540 and mount, PID, IPC, network, and UTS namespaces can be created with just the
 541 .B CAP_SYS_ADMIN
 542 capability in the caller's user namespace.
 543
 544 If
 545 .BR CLONE_NEWUSER
 546 is specified along with other
 547 .B CLONE_NEW*
 548 flags in a single
 549 .BR clone (2)
 550 or
 551 .BR unshare (2)
 552 call, the user namespace is guaranteed to be created first,
 553 giving the caller privileges over the remaining
 554 namespaces created by the call.
 555 Thus, it is possible for an unprivileged caller to specify this combination
 556 of flags.
 557
 558 The following rules apply with respect to the capabilities granted
 559 to a process:
 560 .\" In the 3.8 sources, see security/commoncap.c::cap_capable():
 561 .IP 1. 3
 562 If a process has a capability in a parent user namespace,
 563 then it has that capability in all child (and further removed descendant)
 564 namespaces as well.
 565 .IP 2.
 566 .\" * The owner of the user namespace in the parent of the
 567 .\" * user namespace has all caps.
 568 When a user namespace is created, the kernel records the effective
 569 user ID of the creating process as being the "owner" of the namespace,
 570 and likewise associates the effective group ID of the creating process
 571 with the namespace.
 572 A process whose effective user ID matches that of the
 573 owner of a user namespace and which is a member of the parent namespace
 574 (or a further removed namespace that is a direct ancestor)
 575 has all capabilities in the user namespace.
 576 .\" As a rough approximation, this means that
 577 .\" the user who creates a user namespace
 578 .\" has all capabilities inside that namespace and its descendants.
 579 .PP
 580 Use of user namespaces requires a kernel that is configured with the
 581 .B CONFIG_USER_NS
 582 option.
 583
 584 Over the years, there have been a lot of features that have been added
 585 to the Linux kernel that are only available to privileged users
 586 because of their potential to confuse set-user-ID-root applications.
 587 In general, it becomes safe to allow the root user in a user namespace to
 588 use those features because it is impossible, while in a user namespace,
 589 to gain more privilege than the root user of a user namespace has.
 590
 591 The
 592 .IR /proc/[pid]/uid_map
 593 and
 594 .IR /proc/[pid]/gid_map
 595 files (available since Linux 3.5)
 596 .\" commit 22d917d80e842829d0ca0a561967d728eb1d6303
 597 expose the mappings for user and group IDs
 598 inside the user namespace for the process
 599 .IR pid .
 600 The description here explains the details for
 601 .IR uid_map ;
 602 .IR gid_map
 603 is exactly the same,
 604 but each instance of "user ID" is replaced by "group ID".
 605
 606 The
 607 .I uid_map
 608 file exposes the mapping of user IDs from the user namespace
 609 of the process
 610 .IR pid
 611 to the user namespace of the process that opened
 612 .IR uid_map
 613 (but see a qualification to this point below).
 614 In other words, processes that are in different user namespaces
 615 will potentially see different values when reading from a particular
 616 .I uid_map
 617 file, depending on the user ID mappings for the user namespaces
 618 of the reading processes.
 619
 620 Each line in the
 621 .I uid_map
 622 file specifies a 1-to-1 mapping of a range of contiguous
 623 user IDs between two user namespaces.
 624 (When a user namespace is first created, this file is empty.)
 625 The specification in each line takes the form of
 626 three numbers delimited by white space.
 627 The first two numbers specify the starting user ID in
 628 each user namespace.
 629 The third number specifies the length of the mapped range.
 630 In detail, the fields are interpreted as follows:
 631 .IP (1) 4
 632 The start of the range of user IDs in
 633 the user namespace of the process
 634 .IR pid .
 635 .IP (2)
 636 The start of the range of user
 637 IDs to which the user IDs specified by field one map.
 638 How field two is interpreted depends on whether the process that opened
 639 .I uid_map
 640 and the process
 641 .IR pid
 642 are in the same user namespace, as follows:
 643 .RS
 644 .IP a) 3
 645 If the two processes are in different user namespaces:
 646 field two is the start of a range of
 647 user IDs in the user namespace of the process that opened
 648 .IR uid_map .
 649 .IP b)
 650 If the two processes are in the same user namespace:
 651 field two is the start of the range of
 652 user IDs in the parent user namespace of the process
 653 .IR pid .
 654 This case enables the opener of
 655 .I uid_map
 656 (the common case here is opening
 657 .IR /proc/self/uid_map )
 658 to see the mapping of user IDs into the user namespace of the process
 659 that created this user namespace.
 660 .RE
 661 .IP (3)
 662 The length of the range of user IDs that is mapped between the two
 663 user namespaces.
 664 .PP
 665 After the creation of a new user namespace, the
 666 .I uid_map
 667 file of
 668 .I one
 669 of the process in the namespace may be written to
 670 .I once
 671 to define the mapping of user IDs in the new user namespace.
 672 (An attempt to write more than once to a
 673 .I uid_map
 674 file in a user namespace fails with the error
 675 .BR EPERM .)
 676
 677 The lines written to
 678 .IR uid_map
 679 must conform to the following rules:
 680 .IP * 3
 681 The three fields must be valid numbers,
 682 and the last field must be greater than 0.
 683 .IP *
 684 Lines are terminated by newline characters.
 685 .IP *
 686 There is an (arbitrary) limit on the number of lines in the file.
 687 As at Linux 3.8, the limit is five lines.
 688 In addition, the number of bytes written to
 689 the file must be less than the system page size,
 690 .\" FIXME(Eric): the restriction "less than" rather than "less than or equal"
 691 .\" seems strangely arbitrary. Furthermore, the comment does not agree
 692 .\" with the code in kernel/user_namespace.c. Which is correct.
 693 and the write must be performed at the start of the file (i.e.,
 694 .BR lseek (2)
 695 and
 696 .BR pwrite (2)
 697 can't be used to write to nonzero offsets in the file).
 698 .IP *
 699 The range of user IDs specified in each line cannot overlap with the ranges
 700 in any other lines.
 701 In the current implementation (Linux 3.8), this requirement is
 702 satisfied by a simplistic implementation that imposes the further
 703 requirement that
 704 the values in both field 1 and field 2 of successive lines must be
 705 in ascending numerical order.
 706 .IP *
 707 At least one line must be written to the file.
 708 .PP
 709 Writes that violate the above rules fail with the error
 710 .BR EINVAL .
 711
 712 In order for a process to write to the
 713 .I /proc/[pid]/uid_map
 714 .RI ( /proc/[pid]/gid_map )
 715 file, all of the following requirements must be met:
 716 .IP 1. 3
 717 The writing process must have the
 718 .BR CAP_SETUID
 719 .RB ( CAP_SETGID )
 720 capability in the user namespace of the process
 721 .IR pid .
 722 .\" FIXME(Eric):
 723 .\" Something isn't quite right in the description here.
 724 .\" Suppose UID 1000 creates a user namespace. At this point, UID 0 in
 725 .\" the parent namespace can write a map of (say) '0 1000 10' to uid_map.
 726 .\" That succeeds. But how is that case covered in the three rules here?
 727 .\" In other words, how does UID 0 in the parent namespace have any
 728 .\" capabilities in the new child namespace? Somewhere on the page,
 729 .\" I think there needs to be a statement about the privileges of
 730 .\" UID 0 when no mapping has yet been defined, right?
 731 .\" Or is it simply the case that UID 0 in the parent namespace
 732 .\" always has all capabilities in the child namespace?
 733 .\"
 734 .IP 2.
 735 The writing process must be in either the user namespace of the process
 736 .I pid
 737 or inside the parent user namespace of the process
 738 .IR pid .
 739 .IP 3.
 740 One of the following is true:
 741 .RS
 742 .IP * 3
 743 The data written to
 744 .I uid_map
 745 .RI ( gid_map )
 746 consists of a single line that maps the writing process's file system user ID
 747 (group ID) in the parent user namespace to a user ID (group ID)
 748 in the user namespace.
 749 The usual case here is that this single line provides a mapping for user ID
 750 of the process that created the namespace.
 751 .IP * 3
 752 The process has the
 753 .BR CAP_SETUID
 754 .RB ( CAP_SETGID )
 755 capability in the parent user namespace.
 756 Thus, a privileged process can make mappings to arbitrary user IDs (group IDs)
 757 in the parent user namespace.
 758 .RE
 759 .PP
 760 Writes that violate the above rules fail with the error
 761 .BR EPERM .
 762 .PP
 763 When a process inside a user namespace executes
 764 a set-user-ID (set-group-ID) program,
 765 the process's effective user (group) ID inside the namespace is changed
 766 to whatever value is mapped for the user (group) ID of the file.
 767 However, if either the user
 768 .I or
 769 the group ID of the file has no mapping inside the namespace,
 770 the set-user-ID (set-group-ID) bit is silently ignored:
 771 the new program is executed,
 772 but the process's effective user (group) ID is left unchanged.
 773 (This mirrors the semantics of executing a set-user-ID or set-group-ID
 774 program that resides on a file system that was mounted with the
 775 .BR MS_NOSUID
 776 flag (see
 777 .BR mount (2).)
 778 .\"
 779 .\" ==================== UTS namespaces ====================
 780 .\"
 781 .SS UTS namespaces (CLONE_NEWUTS)
 782 UTS namespaces provide isolation of two system identifiers:
 783 the hostname and the NIS domain name.
 784 These identifiers are set using
 785 .BR sethostname (2)
 786 and
 787 .BR setdomainname (2),
 788 and can be retrieved using
 789 .BR uname (2),
 790 .BR gethostname (2),
 791 and
 792 .BR getdomainname (2).
 793
 794 Use of UTS namespaces requires a kernel that is configured with the
 795 .B CONFIG_UTS_NS
 796 option.
 797 .SH CONFORMING TO
 798 Namespaces are a Linux-specific feature.
 799 .SH SEE ALSO
 800 .BR nsenter (1),
 801 .BR readlink (1),
 802 .BR unshare (1),
 803 .BR clone (2),
 804 .BR setns (2),
 805 .BR unshare (2),
 806 .BR proc (5),
 807 .BR credentials (7),
 808 .BR capabilities (7),
 809 .BR switch_root (8)