mirror of https://github.com/mkerrisk/man-pages
205 lines
4.9 KiB
Groff
205 lines
4.9 KiB
Groff
.\" Copyright (C) 2011, Eric Biederman <ebiederm@xmission.com>
|
|
.\" and Copyright (C) 2011, 2012, Michael Kerrisk <mtk.manpages@gamil.com>
|
|
.\"
|
|
.\" %%%LICENSE_START(GPLv2_ONELINE)
|
|
.\" Licensed under the GPLv2
|
|
.\" %%%LICENSE_END
|
|
.\"
|
|
.TH SETNS 2 2013-01-01 "Linux" "Linux Programmer's Manual"
|
|
.SH NAME
|
|
setns \- reassociate thread with a namespace
|
|
.SH SYNOPSIS
|
|
.nf
|
|
.BR "#define _GNU_SOURCE" " /* See feature_test_macros(7) */"
|
|
.B #include <sched.h>
|
|
.sp
|
|
.BI "int setns(int " fd ", int " nstype );
|
|
.fi
|
|
.SH DESCRIPTION
|
|
Given a file descriptor referring to a namespace,
|
|
reassociate the calling thread with that namespace.
|
|
|
|
The
|
|
.I fd
|
|
argument is a file descriptor referring to one of the namespace entries in a
|
|
.I /proc/[pid]/ns/
|
|
directory; see
|
|
.BR proc (5)
|
|
for further information on
|
|
.IR /proc/[pid]/ns/ .
|
|
The calling thread will be reassociated with the corresponding namespace,
|
|
subject to any constraints imposed by the
|
|
.I nstype
|
|
argument.
|
|
|
|
The
|
|
.I nstype
|
|
argument specifies which type of namespace
|
|
the calling thread may be reassociated with.
|
|
This argument can have one of the following values:
|
|
.TP
|
|
.BR 0
|
|
Allow any type of namespace to be joined.
|
|
.TP
|
|
.BR CLONE_NEWIPC
|
|
.I fd
|
|
must refer to an IPC namespace.
|
|
.TP
|
|
.BR CLONE_NEWNET
|
|
.I fd
|
|
must refer to a network namespace.
|
|
.TP
|
|
.BR CLONE_NEWUTS
|
|
.I fd
|
|
must refer to a UTS namespace.
|
|
.PP
|
|
Specifying
|
|
.I nstype
|
|
as 0 suffices if the caller knows (or does not care)
|
|
what type of namespace is referred to by
|
|
.IR fd .
|
|
Specifying a nonzero value for
|
|
.I nstype
|
|
is useful if the caller does not know what type of namespace is referred to by
|
|
.IR fd
|
|
and wants to ensure that the namespace is of a particular type.
|
|
(The caller might not know the type of the namespace referred to by
|
|
.IR fd
|
|
if the file descriptor was opened by another process and, for example,
|
|
passed to the caller via a UNIX domain socket.)
|
|
.SH RETURN VALUE
|
|
On success,
|
|
.IR setns ()
|
|
returns 0.
|
|
On failure, \-1 is returned and
|
|
.I errno
|
|
is set to indicate the error.
|
|
.SH ERRORS
|
|
.TP
|
|
.B EBADF
|
|
.I fd
|
|
is not a valid file descriptor.
|
|
.TP
|
|
.B EINVAL
|
|
.I fd
|
|
refers to a namespace whose type does not match that specified in
|
|
.IR nstype ,
|
|
or there is problem with reassociating the
|
|
the thread with the specified namespace.
|
|
.TP
|
|
.B ENOMEM
|
|
Cannot allocate sufficient memory to change the specified namespace.
|
|
.TP
|
|
.B EPERM
|
|
The calling thread did not have the required privilege
|
|
.RB ( CAP_SYS_ADMIN )
|
|
for this operation.
|
|
.SH VERSIONS
|
|
The
|
|
.BR setns ()
|
|
system call first appeared in Linux in kernel 3.0;
|
|
library support was added to glibc in version 2.14.
|
|
.SH CONFORMING TO
|
|
The
|
|
.BR setns ()
|
|
system call is Linux-specific.
|
|
.SH NOTES
|
|
Not all of the attributes that can be shared when
|
|
a new thread is created using
|
|
.BR clone (2)
|
|
can be changed using
|
|
.BR setns ().
|
|
.SH EXAMPLE
|
|
The program below takes two or more arguments.
|
|
The first argument specifies the pathname of a namespace file in an existing
|
|
.I /proc/[pid]/ns/
|
|
directory.
|
|
The remaining arguments specify a command and its arguments.
|
|
The program opens the namespace file, joins that namespace using
|
|
.BR setns (),
|
|
and executes the specified command inside that namespace.
|
|
|
|
The following shell session demonstrates the use of this program
|
|
(compiled as a binary named
|
|
.IR ns_exec )
|
|
in conjunction with the
|
|
.BR CLONE_NEWUTS
|
|
example program in the
|
|
.BR clone (2)
|
|
man page (complied as a binary named
|
|
.IR newuts ).
|
|
|
|
We begin by executing the example program in
|
|
.BR clone (2)
|
|
in the background.
|
|
That program creates a child in a separate UTS namespace.
|
|
The child changes the hostname in its namespace,
|
|
and then both processes display the hostnames in their UTS namespaces,
|
|
so that we can see that they are different.
|
|
|
|
.nf
|
|
.in +4n
|
|
$ \fBsu\fP # Need privilege for namespace operations
|
|
Password:
|
|
# \fB./newuts bizarro &\fP
|
|
[1] 3549
|
|
clone() returned 3550
|
|
uts.nodename in child: bizarro
|
|
uts.nodename in parent: antero
|
|
# \fBuname \-n\fP # Verify hostname in the shell
|
|
antero
|
|
.in
|
|
.fi
|
|
|
|
We then run the program shown below,
|
|
using it to execute a shell.
|
|
Inside that shell, we verify that the hostname is the one
|
|
set by the child created by the first program:
|
|
|
|
.nf
|
|
.in +4n
|
|
# \fB./ns_exec /proc/3550/ns/uts /bin/bash\fP
|
|
# \fBuname \-n\fP # Executed in shell started by ns_exec
|
|
bizarro
|
|
.in
|
|
.fi
|
|
.SS Program source
|
|
.nf
|
|
#define _GNU_SOURCE
|
|
#include <fcntl.h>
|
|
#include <sched.h>
|
|
#include <unistd.h>
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
|
|
#define errExit(msg) do { perror(msg); exit(EXIT_FAILURE); \\
|
|
} while (0)
|
|
|
|
int
|
|
main(int argc, char *argv[])
|
|
{
|
|
int fd;
|
|
|
|
if (argc < 3) {
|
|
fprintf(stderr, "%s /proc/PID/ns/FILE cmd args...\\n", argv[0]);
|
|
exit(EXIT_FAILURE);
|
|
}
|
|
|
|
fd = open(argv[1], O_RDONLY); /* Get descriptor for namespace */
|
|
if (fd == \-1)
|
|
errExit("open");
|
|
|
|
if (setns(fd, 0) == \-1) /* Join that namespace */
|
|
errExit("setns");
|
|
|
|
execvp(argv[2], &argv[2]); /* Execute a command in namespace */
|
|
errExit("execvp");
|
|
}
|
|
.fi
|
|
.SH SEE ALSO
|
|
.BR clone (2),
|
|
.BR fork (2),
|
|
.BR vfork (2),
|
|
.BR proc (5),
|
|
.BR unix (7)
|