Qual regra impede a entrada de um namespace de usuário dentro de um chroot?

Question

# rpm -q --whatprovides /usr/bin/unshare
util-linux-2.32-2.fc28.x86_64
# unshare -r
#

i.e. o acima tem sucesso, onde o seguinte não. Qual regra faz isso?

# rpm -q --whatprovides /usr/sbin/chroot
coreutils-8.29-6.fc28.x86_64
# chroot fedora-27
# rpm -q --whatprovides /usr/bin/unshare
util-linux-2.30.2-1.fc27.x86_64
# strace unshare -r
...
unshare(CLONE_NEWUSER)      = -1 EPERM (Operation not permitted)

    

Answer 1

link

It's well-known that processes that are capable of using chroot, are capable of breaking out of a chroot. Since unshare -r would grant chroot permissions to an ordinary user, it would be a security risk if that was allowed inside a chroot environment. Indeed, it is not allowed, and fails with:

unshare: unshare failed: Operation not permitted

     

que corresponde ao    sem compartilhamento (2)   documentação (desculpas pelo ousado estranho, mas é isso que   parece):

     

EPERM (since Linux 3.9)

CLONE_NEWUSER was specified in flags and the caller is in a chroot environment (i.e., the caller's root directory does not match the root directory of the mount namespace in which it resides).