For review: user_namespaces(7) man page

richard -rw- weinberger richard.weinberger at
Mon Apr 29 07:45:45 UTC 2013

On Thu, Mar 21, 2013 at 4:52 PM, Michael Kerrisk (man-pages)
<mtk.manpages at> wrote:
> Hi Serge,
> On Fri, Mar 15, 2013 at 4:38 PM, Serge Hallyn <serge.hallyn at> wrote:
>> Hi,
>> you mention that after creating a new user namespace you at first have
>> all capabilities in the new ns.  You don't explicitly mention (or I
>> missed it - I did see the mention of securebits) that if you want to
>> keep those capabilities after doing an exec, you need to first have
>> something mapped to uid 0 in the userns, and do setuid(0).
> Good point. I'll add something on that.
>> You might not want to list manpages from other projects,
> Actually, not a problem. Many of the pages in my set already do this.
>> but Eric's
>> shadow patches introduce some good new manpages as well.  Those aren't yet
>> accepted upstream, but if/when they are then mention at least of
>> subuid(5), subgid(5), and newuidmap(1) and newgidmap(1) might be good.
> I'll add those.
> Cheers,
> Michael

Can we please also document which capabilities are useless within an
user namespace?
You get this capability but the kernel always checks it against the
initial userns.


More information about the Containers mailing list