File: lxc-usernsexec.sgml.in

package info (click to toggle)
lxc 1%3A1.0.6-6
  • links: PTS, VCS
  • area: main
  • in suites: jessie-kfreebsd
  • size: 4,800 kB
  • sloc: ansic: 33,735; sh: 11,868; python: 1,223; makefile: 734
file content (156 lines) | stat: -rw-r--r-- 4,266 bytes parent folder | download | duplicates (8)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
<!--

lxc: linux Container library

(C) Copyright IBM Corp. 2007, 2008

Authors:
Daniel Lezcano <daniel.lezcano at free.fr>
Serge Hallyn <serge.hallyn at ubuntu.com>

This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.

This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

-->

<!DOCTYPE refentry PUBLIC @docdtd@ [

<!ENTITY commonoptions SYSTEM "@builddir@/common_options.sgml">
<!ENTITY seealso SYSTEM "@builddir@/see_also.sgml">
]>

<refentry>

  <docinfo><date>@LXC_GENERATE_DATE@</date></docinfo>

  <refmeta>
    <refentrytitle>lxc-usernsexec</refentrytitle>
    <manvolnum>1</manvolnum>
  </refmeta>

  <refnamediv>
    <refname>lxc-usernsexec</refname>

    <refpurpose>
      Run a task as root in a new user namespace.
    </refpurpose>
  </refnamediv>

  <refsynopsisdiv>
    <cmdsynopsis>
      <command>lxc-usernsexec</command>
      <arg choice="opt">-m <replaceable>uid-map</replaceable></arg>
      <arg choice="req">-- command</arg>
    </cmdsynopsis>
  </refsynopsisdiv>

  <refsect1>
    <title>Description</title>

    <para>
      <command>lxc-usernsexec</command> can be used to run a task as root
      in a new user namespace.
    </para>

  </refsect1>

  <refsect1>

    <title>Options</title>

    <variablelist>

      <varlistentry>
	<term>
	  <option>-m <replaceable>uid-map</replaceable></option>
	</term>
	<listitem>
	  <para>
	  The uid map to use in the user namespace.  Each map consists of
	  four colon-separate values.  First a character 'u', 'g' or 'b' to
	  specify whether this map pertains to user ids, group ids, or
	  both; next the first userid in the user namespace;  next the
	  first userid as seen on the host;  and finally the number of
	  ids to be mapped.
	  </para>
	  <para>
	  More than one map can be specified.  If no map is
	  specified, then by default the full uid and gid ranges granted
	  by /etc/subuid and /etc/subgid will be mapped to the
	  uids and gids starting at 0 in the container.
	  </para>
	  <para>
	  Note that <replaceable>lxc-usernsexec</replaceable> always tries
	  to setuid and setgid to 0 in the namespace.  Therefore uid 0 in
	  the namespace must be mapped.
	  </para>
	</listitem>
      </varlistentry>


    </variablelist>

  </refsect1>

  <refsect1>
    <title>Examples</title>
      <para>
        To spawn a shell with the full allotted subuids mapped into
	the container, use
        <programlisting>
	  lxc-usernsexec
        </programlisting>
	To run a different shell than <replaceable>/bin/sh</replaceable>, use
        <programlisting>
	  lxc-usernsexec -- /bin/bash
        </programlisting>
      </para>
      <para>
	If your user id is 1000, root in a container is mapped to 190000, and
	you wish to chown a file you own to root in the container, you can use:
        <programlisting>
	  lxc-usernsexec -m b:0:1000:1 -m b:1:190000:1 -- /bin/chown 1:1 $file
        </programlisting>
	This maps your userid to root in the user namespace, and 190000 to uid 1.
	Since root in the user namespace is privileged over all userids mapped
	into the namespace, you are allowed to change the file ownership, which
	you could not do on the host using a simple chown.
      </para>
  </refsect1>

  &seealso;

  <refsect1>
    <title>Author</title>
    <para>Serge Hallyn <email>serge.hallyn@ubuntu.com</email></para>
  </refsect1>

</refentry>

<!-- Keep this comment at the end of the file
Local variables:
mode: sgml
sgml-omittag:t
sgml-shorttag:t
sgml-minimize-attributes:nil
sgml-always-quote-attributes:t
sgml-indent-step:2
sgml-indent-data:t
sgml-parent-document:nil
sgml-default-dtd-file:nil
sgml-exposed-tags:nil
sgml-local-catalogs:nil
sgml-local-ecat-files:nil
End:
-->