~/talk

Understanding user namespaces

Talkat foss-north 2019 · 2019-04-07..04-10· [linux-and-operating-systems, security]

speaker

name:Michael Kerrisk

website:http://man7.org/

resources

video:https://youtu.be/83NOk8pmHi8

slides:none on file

summary

Explains how user namespaces let a process be UID 0 inside a namespace while mapping to an unprivileged UID outside, shows actual commands (unshare and nsenter), inspects /proc/*/ns symlinks and /proc/[pid]/uid_map and gid_map, and demonstrates changing a hostname inside a new UTS namespace while being unable to bind privileged network ports because the network namespace is owned by the initial user namespace. Shows capability bitmasks (all bits set inside the namespace), describes root-mapping examples and past kernel corner‑case fixes and remaining security tradeoffs.

AI-written summary · about

chapters (4)

related talks