Mounting proc in an unencrypted, isolated namespace

Question

I am trying to create a sandbox using Linux namespaces. I found a neat example in https://github.com/swetland/mkbox , which roughly does what I want, but I would like for the trustworthy / proc to appear inside the sandbox. How can i do this?

I tried to associate the proc FS installation with "proc", but that is not with EINVAL. When I try to install "proc" normally, this gives EPERM.

ideas?

Answer 1

The local guru understood this for me: proc should use the MS_REC flag (undocumented?), For example:

    ok(mount, "/proc", "proc", NULL, MS_REC|MS_BIND, NULL);

- , CLONE_PIDNS , .

Answer 2

, , , EPERM , CLONE_NEWUSER | CLONE_NEWNS, CLONE_NEWPID. , proc CAP_SYS_ADMIN , PID, .

Linux 4.4, fs/proc/root.c, 112-117:

ns = task_active_pid_ns(current);
options = data;

/* Does the mounter have privilege over the pid namespace? */
if (!ns_capable(ns->user_ns, CAP_SYS_ADMIN))
        return ERR_PTR(-EPERM);