Recursos do Linux com espaços para nome de usuário

Question

Estou confuso sobre como os recursos de arquivo funcionam em relação aos namespaces de usuário. Pelo que entendi, se um arquivo tem uma capacidade, então qualquer thread / processo executando o arquivo pode atingir o recurso.

No meu ping binário, eu tenho o recurso CAP_NET_RAW definido, e não há nenhum setuid.

# CAP_NET_RAW is set
→ getcap 'which ping'                                               
/bin/ping = cap_net_raw+ep

# There is no setuid
→ ls -l 'which ping'                                                 
-rwxr-xr-x 1 root root 64424 Mar  9  2017 /bin/ping

# ping works...
→ ping -c 1 google.com                                               
PING google.com (172.217.6.46) 56(84) bytes of data.                                                  
64 bytes from sfo03s08-in-f14.1e100.net (172.217.6.46): icmp_seq=1 
ttl=54 time=11.9 ms                

--- google.com ping statistics ---                 
1 packets transmitted, 1 received, 0% packet loss, time 0ms                                           
rtt min/avg/max/mdev = 11.973/11.973/11.973/0.000 ms  

Então porque é que não consigo pingar do meu namespace de usuário?

→ ping google.com      
ping: socket: Operation not permitted 

→ capsh --print        
Current: = ...cap_net_raw...+ep                                                         
Bounding set =...cap_net_raw...                                                       
Securebits: 00/0x0/1'b0                            
secure-noroot: no (unlocked)                      
secure-no-suid-fixup: no (unlocked)               
secure-keep-caps: no (unlocked)                   
uid=0(root)                                        
gid=0(root)                                        

→ getcap 'which ping'  
/bin/ping = cap_net_raw+ep      

    

Answer 1

The child process created by clone(2) with the CLONE_NEWUSER flag starts out with a complete set of capabilities in the new user namespace. Likewise, a process that creates a new user namespace using unshare(2) or joins an existing user namespace using setns(2) gains a full set of capabilities in that namespace. On the other hand, that process has no capabilities in the parent (in the case of clone(2)) or previous (in the case of unshare(2) and setns(2)) user namespace, even if the new namespace is created or joined by the root user (i.e., a process with user ID 0 in the root namespace).

...

When a non-user-namespace is created, it is owned by the user namespace in which the creating process was a member at the time of the creation of the namespace. Actions on the non-user-namespace require capabilities in the corresponding user namespace.

- link

Você não pode obter acesso bruto à rede a interfaces de rede que você não possui!

$ unshare -r
# ping -c1 127.0.0.1
ping: socket: Operation not permitted

Compare:

$ unshare -rn
# ping -c1 127.0.0.1
connect: Network is unreachable
# ip link set dev lo up    # apparently the 'lo' interface is pre-created.
# ping -c1 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.048 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.048/0.048/0.048/0.000 ms