Mapping two users to host with user namespaces

Question

I'm trying to understand whether it's possible to map two users from a user namespace to two different users on the host.

The goal is to replicate the same permissions I have on my host inside a rootfs (Ubuntu base, because I'm trying to build a container from scratch).

For example:

• Everything under / should belong to root.
• /home/user should belong to the regular user.

To achieve this, I was thinking of using UID mapping in a user namespace, something like:

UID in user namespace ---> UID on host 1000 (admin) -> 0 (root) 1001 (bob) -> 1001 (bob) 

Is this kind of mapping even possible?

Here’s what I’ve already tried:

• Running echo -e "1000 0 1\n1001 1001 1" > /proc/[PID]/uid_map to define the mapping, but I get an error.
• Trying to manually modify /proc/[PID]/uid_map using newuidmap for each user.

However, I’ve never been able to map more than one user, and I can’t seem to map UID 0 (root) at all.

I’ve read the man pages and followed the constraints mentioned there, but I’m still getting error messages.

For example:

# terminal 1 unshare --user bash echo $$ # 11591 

# terminal 2 as user 'alex' (uid = 1000) newuidmap 11591 0 0 1 # newuidmap: uid range [0-1) -> [0-1) not allowed newuidmap 11591 1001 1001 1 # newuidmap: uid range [1001-1002) -> [1001-1002) not allowed 

These commands fail, even when run with sudo.

I also tried mapping to subuids that I’ve declared, but it still doesn’t work:

cat /etc/subuid alex:100000:65536 root:200000:65536 self:300000:65536 cat /etc/subgid alex:100000:65536 root:200000:65536 self:300000:65536 

Answer 1

The kernel documentation states that only one UID/GID in the namespace may be mapped to host UID/GID 0. A single UID-0 mapping, 1000 0 1 must appear before any other mappings.

Check user and group ID mappings: uid_map and gid_map.

• https://man7.org/linux/man-pages/man7/user_namespaces.7.html

• https://man7.org/linux/man-pages/man7/pid_namespaces.7.html

Range overlaps are prohibited. For example, 1001 1001 1 must not conflict with the first mapping.

Without newuidmap, the operation fails due to insufficient permissions, even as root inside the namespace.

Non-privileged users can only create mappings within their assigned sub-UIDs/GIDs.

From /etc/subuid:

• https://man7.org/linux/man-pages/man5/subuid.5.html

From /etc/subgid:

• https://man7.org/linux/man-pages/man5/subgid.5.html

Use newuidmap and newgidmap to set up secure mappings.

The man page explains the syntax:

• https://man7.org/linux/man-pages/man1/newuidmap.1.html

There are users here who can explain this in more detail ^^