NAME

userbindmount - bind-mount utility for user-namespaces

SYNOPSIS

userbindmount [options] [source target [source target [...]]] [ -- [cmd [args]]]

DESCRIPTION

userbindmount is a utility command based on libuserbindmount.

It can be used to perform one or more bind-mount operation and to create a user-namespace where bind-mount is allowed.

This command does not need root access or specific capabilities to run (provided user-namespaces are supported, see NOTES).

The command line arguments are a list of source-target pairs (one for each bind-mount operation). A new namespace is created if requested by the specific option (-n or --newns) or if there is -- as an option in the command line. If source is a double quoted string, the value of the string will be the content of the file mounted on target. The trailing -- followed by a command and its argument define the command to run in the new namespace. ($SHELL is launched if the command is omitted)

The contents of the file to be mounted on target is read from the standard input if the correspondent source is the tag "-".

OPTIONS

userbindmount accepts the following options.

-n

--newns

create a new user-namespace

-s

--sysadm

add the CAP_SYS_ADMIN ambient capability to the current of newly created userspace

-v

--verbose

verbose mode: print debugging information on the actions taken by the program.

NOTES

User namespaces require a kernel that is configured with the CONFIG_USER_NS option. In some distributions (e.g. Debian) user namespaces must be enabled by writing 1 to /proc/sys/kernel/unprivileged_userns_clone.

EXAMPLES

The following example mounts the file /tmp/resolv.conf instead of /etc/resolv.conf: the purpose of this example is to redefine the name servers for the name resolution.

$ cat /etc/resolv.conf
nameserver 127.0.0.1
$ echo "nameserver 9.9.9.9" > /tmp/resolv.conf
$ userbindmount -v /tmp/resolv.conf /etc/resolv.conf -- bash
creating a user_namespace
mounting /tmp/resolv.conf on /etc/resolv.conf
starting bash
$ cat /etc/resolv.conf 
nameserver 9.9.9.9
$ exit
$

The following example creates a namespace where bind-mount is allowed and then mounts /tmp/resolv.conf on /etc/resolv.conf. (It uses busybox instead of mount(8) as the latter does not support the capabilities, yet).

$ userbindmount -s -- bash
$ cat /etc/resolv.conf 
nameserver 127.0.0.1
$ echo "nameserver 9.9.9.9" > /tmp/resolv.conf
$ busybox mount --bind /tmp/resolv.conf /etc/resolv.conf 
$ cat /etc/resolv.conf
nameserver 9.9.9.9
$ exit
$

Several bind-mounts can be done in a user-namespace started with the -s option. No more namespaces are needed in this case. The contents of the file to mount can be taken from stdin if source is "-".

$ userbindmount -sn
$ echo "nameserver 9.9.9.9" | userbindmount - /etc/resolv.conf
$ cat /etc/resolv.conf
nameserver 9.9.9.9
$ exit

It is possible to set the contents of a mounted file directly in the command line:

$ userbindmount $'"nameserver 9.9.9.9\n"' /etc/resolv.conf -- bash
$ cat /etc/resolv.conf
nameserver 9.9.9.9
$ exit

Please note that the following command:

$ echo "nameserver 9.9.9.9" | userbindmount - /etc/resolv.conf -- bash

SEE ALSO

libuserbindmount(3), mount(8), user_namespaces(7), capabilities(7)