Unable to create user namespace in RHEL

Question

I'm trying to create user namespace in RHEL 7 but unable to because of the below error:

[root@teja7131 ~]# unshare -U /bin/bash
unshare: unshare failed: Invalid argument

Please explain the correct argument format for creating the user namespace.

Solution

If one uses strace to inspect the command

$ strace -o logf -f unshare -U sh
unshare: unshare failed: Invalid argument
$ grep 'Invalid argument' logf
31728 unshare(CLONE_NEWUSER)            = -1 EINVAL (Invalid argument)
31728 write(2, "Invalid argument\n", 17) = 17

this reveals that the system call unshare(2) has failed. Notably CLONE_NEWUSER does not appear in the manual page, which could be a documentation bug or could indicate that CLONE_NEWUSER is not supported on a stock install of RedHat 7 (I'm using Centos7 here on a test system, which is similar to but different from RedHat 7).

$ man 2 unshare | col -b | grep CLONE_NEWUSER
$ 

This is strange; altagoobingleduckgoing the terms unshare and CLONE_NEWUSER yields questions about unshare(CLONE_NEWUSER) though from that CONFIG_USER_NS is apparently enabled on Centos 7:

$ grep CONFIG_USER_NS /boot/config-$(uname -r)
CONFIG_USER_NS=y

Yet more altagoobingleduckgoing turns up an lxc thread that indicates that "Currently user namespaces are in TECH PREVIEW phase" (as of RedHat 7.2) so may or may not work. Adding user_namespace.enable=1 to the kernel arguments did not help on my Centos 7.5 system (and is not necessary in testing, below). The Kernel features page however lists user namespaces as supported; Filipe Brandenburger found is it safe to enable user namespaces which indicates that by default RedHat 7 enables 0 namespaces for users, though this number can be increased:

# cat /proc/sys/user/max_user_namespaces
0
# echo 640 > /proc/sys/user/max_user_namespaces
# unshare -U sh
sh-4.2$ 

So increasing max_user_namespaces on Centos 7.5 works, and does not require the user_namespace.enable=1 kernel flag.

Even more reading:

https://rhelblog.redhat.com/2015/07/07/whats-next-for-containers-user-namespaces/

Comments

[filbranden]

See also superuser.com/a/1294246/879179, perhaps you need to tweak /proc/sys/user/max_user_namespaces as well on recent RHEL 7 kernels.