{{tag>Brouillon Linux}}
= Notes Linux kernel namespaces espace de noms
** Brouillon**
Voir :
* [[Network Namespaces - netns - /etc/hosts que pour une appli spécifique]]
* [[https://www.redhat.com/sysadmin/container-namespaces-nsenter|Manage containers in namespaces by using nsenter]]
* https://blog.stephane-robert.info/docs/admin-serveurs/linux/namespaces/
* https://linuxfr.org/users/trim/journaux/utiliser-podman-en-mode-rootless-pour-executer-en-service-des-containers-rootless
* https://man7.org/linux/man-pages/man7/user_namespaces.7.html
* https://developers.redhat.com/blog/2020/09/25/rootless-containers-with-podman-the-basics#example__using_rootless_containers
* https://github.com/rootless-containers/slirp4netns (va être remplacé par **pasta** à partir de Podman 5)
* https://blog.quarkslab.com/digging-into-linux-namespaces-part-1.html
* https://blog.quarkslab.com/digging-into-linux-namespaces-part-2.html
* https://ifeanyi.co/posts/linux-namespaces-part-3/
* https://blog.quarkslab.com/digging-into-linux-namespaces-part-2.html
* https://www.redhat.com/en/blog/building-container-namespaces
* https://www.redhat.com/en/blog/container-namespaces-nsenter
Sécurité - échappement :
* https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation/index.html
== Commandes unshare nsenter
Voir :
* https://commandmasters.com/commands/nsenter-linux/
* https://thelinuxcode.com/nsenter-linux-command/
* https://knowledge.broadcom.com/external/article/389166/using-nsenter-for-troubleshooting-kubern.html
yum install util-linux
Voir :
* unshare
* share
* runc
* /proc/self/uid_map
jb@vmdeb1:~$ # sudo unshare --fork --pid --mount-proc bash
jb@vmdeb1:~$ unshare -U -r -m --mount-proc -f -p
root@vmdeb1:/home/jb# ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 17:18 pts/5 00:00:00 bash
root 2 1 0 17:18 pts/5 00:00:00 ps -ef
unshare -m -u -i -n -p -f --mount-proc bash
sudo $(which runc) run test1
ip netns
lsns
nsenter
paramètre noyau
''user_namespace.enable=1''
Red Hat / CentOS
#grubby --args="namespace.unpriv_enable=1 user_namespace.enable=1" --update-kernel="$(grubby --default-kernel)"
grubby --args="user_namespace.enable=1" --update-kernel=/boot/vmlinuz-$(uname -r)
cat /proc/sys/user/max_user_namespaces
== Docker userns-remap namespace
Voir :
* https://www.alexisjanvier.net/bind-user-on-docker-container
* https://www.jujens.eu/posts/en/2017/Jul/02/docker-userns-remap/
* https://www.devoteam.com/fr/expert-view/la-migration-vers-podman-est-elle-la-solution-pour-se-passer-de-docker/
== userns-remap=utilisateur
''/root/daemon.json''
{
"userns-remap": "USER"
}
"USER" doit être un utilisateur valide du système hôte (présent dans /etc/passwd)
Pour '' /etc/subuid'' et ''/etc/subgid'' la syntaxe est la suivante :
''user:start_uid:uid_count''
La valeur du count doit logiquement être supérieur ou égale à l'UID max du conteneur (normalement l'utilisateur nobody)
docker run -ti --rm alpine cat /etc/passwd |cut -d: -f 3 |sort -n |tail -1
Autres
''/etc/subuid''
plop:1000:1
plop:100000:65536
''/etc/subgid''
plop:982:1
plop:100000:65536
La 1ere ligne : tous les fichiers crées par root appartiendrons à l'UID 1000 et au GID 982
''/etc/subuid'' and ''/etc/subgid'' files can then be edited or changed with ''usermod ''
Exemple
sudo usermod --add-subuids 200000-265535 --add-subgids 200000-265535 demisto
Voir ''podman system migrate''
== kernel.unprivileged_userns_clone
echo kernel.unprivileged_userns_clone = 1 | sudo tee /etc/sysctl.d/00-local-userns.conf
== userns-remap=default dockremap
''/root/daemon.json''
{
"userns-remap": "default"
}
Si vous définisez le champ ''userns-remap'' à ''default'' Docker créera lui-même l’utilisateur ''dockremap'' sur l'hôte.
''/etc/passwd''
dockremap:x:994:990::/home/dockremap:/bin/false
''/etc/subuid''
dockremap:10000:65536
''/etc/subgid''
dockremap:10000:65536
== Exemple process Dockers
$ sudo lsns -t pid
NS TYPE NPROCS PID USER COMMAND
4026531836 pid 128 1 root /lib/systemd/systemd --system --deserialize 21
4026532223 pid 8 359 systemd-timesync nginx: master process /usr/sbin/nginx -g daemon off; -c /opt/etc/nginx/nginx.conf
4026532287 pid 2 21609 root /filebrowser --port 80 --database /data/database.db --root /srv
4026532298 pid 1 20919 root /portainer
4026532410 pid 3 31582 root tini -g -- start-notebook.sh --NotebookApp.token='' --NotebookApp.password=''
4026532477 pid 2 1717 root /bin/sh
$ pstree -p 1717
sh(1717)───sshd(14400)
$ lsns 4026532477
ps -e -o pidns,pid,cmd | grep -v ^$(ps -p 1 -o pidns --no-headers)
# lsns -t pid
NS TYPE NPROCS PID USER COMMAND
4026531836 pid 515 1 root /sbin/init
4026533558 pid 6 8200 root /usr/bin/python /usr/bin/supervisord -c /etc/supervisor/supervisord.conf
4026533561 pid 6 8202 root /usr/bin/python /usr/bin/supervisord -c /etc/supervisor/supervisord.conf
4026533565 pid 6 8219 root /usr/bin/python /usr/bin/supervisord -c /etc/supervisor/supervisord.conf
# lsns 4026533558
PID PPID USER COMMAND
8200 8131 root /usr/bin/python /usr/bin/supervisord -c /etc/supervisor/supervisord.conf
8330 8200 root |-/usr/bin/python /usr/bin/pidproxy /var/run/varnish.pid /opt/varnishwrapper.sh start
8335 8330 root | `-/bin/bash /opt/varnishwrapper.sh start
8342 8335 syslog | `-/usr/sbin/varnishd -F -a :8022 -n varnish_plop -P /var/run/varnish.pid -j unix,user=varnish -T localhost:8123 -f /etc/varnish/instances/plop/main.vcl -S /et
8398 8342 messagebus | `-/usr/sbin/varnishd -F -a :8022 -n varnish_plop -P /var/run/varnish.pid -j unix,user=varnish -T localhost:8123 -f /etc/varnish/instances/plop/main.vcl -S /
8331 8200 root `-/usr/bin/broadcaster -cfg /etc/varnish/instances/plop/nodes.conf -port 8822 -mgmt-port 8722 -server-keep-alive 60m0s -ttl 10m0s -pid /var/run/broadcaster.pid
Voir aussi la commande **systemd-cgtop**
== nsenter
nerdctl inspect --format {{.State.Pid}} kind-control-plane
nsenter --target 6491 --mount --uts --ipc --net --pid
== Réseau
Voir :
* https://passt.top/passt/about/#pasta-pack-a-subtle-tap-abstraction ( **pasta** va remplacer **slirp4netns** à partir de Podman 5)
podman unshare --rootless-netns ip addr
== FS Mount
man 7 mount_namespaces
lsns -t mnt
findmnt -o TARGET,PROPAGATION /
Voir :
* https://connect.ed-diamond.com/GNU-Linux-Magazine/glmf-247/a-la-decouverte-des-namespaces-mount-et-uts
* https://man7.org/linux/man-pages/man7/mount_namespaces.7.html
* https://www.kernel.org/doc/Documentation/filesystems/sharedsubtree.txt
* https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/storage_administration_guide/sect-using_the_mount_command-mounting-bind
* https://lwn.net/Articles/690679/
* http://underpop.online.fr/l/linux/en/centos/sect-using-the-mount-command-mounting-bind.htm
* https://docs.oracle.com/cd/E37670_01/E41138/html/ch18s02.html
* https://unix.stackexchange.com/questions/117414/confusion-about-mount-options
* https://gabrielsantos.org/2020/05/17/77/
* https://jasei.github.io/docker_under_the_hood_talk/examples/02_unshare/
* https://blog.while-true-do.io/containers-behind-the-curtain/
* https://github.com/util-linux/util-linux/issues/289
* https://docs.oracle.com/cd/E37670_01/E41138/html/ch18s02.html
* http://underpop.online.fr/l/linux/en/centos/sect-using-the-mount-command-mounting-bind.htm
* https://lwn.net/Articles/690679/
== Autres
dockerd --userns-remap="testuser:testuser"
To disable user namespaces for a specific container, add the ''--userns=host'' flag
ls -l /var/lib/docker/
== Pb
=== Err unshare failed: Operation not permitted
$ unshare -f --mount-proc -m bash
unshare: unshare failed: Operation not permitted
Solution
$ unshare -U -r -m --mount-proc -f -p
root@vivabelo:~#