NAME¶

vdens - create a user namespace connected to a vde network

SYNOPSIS¶

vdens [ options ] [ vde_network [ command [ args ] ] ]

vdens -m [ options ] vde_network [ vde_network ... ] [ -- command [ args ] ]

vdens --multi [ options ] vde_network [ vde_network ... ] [ -- command [ args ] ]

DESCRIPTION¶

vdens creates a user namespace with a private network namespace.

Vdens launches the command indicated as a parameter ($SHELL if omitted) in a private network namespace.

If the vde_network parameter is present (and it does not match one of the strings "-" or "no") the virtual private network namespace will have a virtual interface connected to the specified vde network.

Vdens grants the capabilities CAP_NET_BIND_SERVICE, CAP_NET_BROADCAST, CAP_NET_ADMIN and CAP_NET_RAW to the command to permit the configuration of the virtual interface. The scope of these capabilities is limited to the user namespace created by vdens. Once the network has been configured, the capabilities can be dropped (e.g. using csdrop(1)) in order to increase the security (obeying to the principle of least privilege).

OPTIONS¶

OPTIONS vdens accepts the following options.

-m

--multi

connect the vde namespace to one or more vde networks. A virtual interface is defined for each vde_network: vde0 is connected to the first vde_network, vde1 is connected to the second and so on. (It is possible to use a different prefix for the interface names instead of "vde", see -i or --iface below).

-i interface_prefix

--iface interface_prefix

define the prefix of the interface name. For example use --iface eth to name the interfaces "eth0", "eth1", etc. (the default value is "vde")

-R ip_addr(s)

--resolvaddr ip_addr(s)

define the address (or addresses) of the domain name servers for the namespace. (multiple IPv4 or IPv6 addresses can be separated by commas, e.g. "-R 9.9.9.9,9.9.8.8")

-r pathname

--resolvconf pathname

define the pathname of the file which will appear as /etc/config.sys in the user namespace. (it is ignored if used together with -R or --resolvaddr)

-s

--sysadm

grant also CAP_SYS_ADMIN in the namespace so that it is possible to bind mount files and directories.

-c

--clone

Use clone(2) to create the private network namespace. Vdens needs one more thread to manage the vde communication.

-u

--unshare

Use unshare(2) to create the private network namespace. It may not work if the vde plugin in use is multithreaded (e.g. slirp). If neither -c/--clone nor -u/--unshare is set, vdens tries unshare first and then it uses clone if unshare fails. (If both are set vdens uses clone).

ENVIRONMENT VARIABLES¶

VDE_RESOLVCONF

define the default value for the --resolvconf option

VDE_RESOLVADDR

define the default value for the --resolvaddr option

NOTES¶

Use of user namespaces requires a kernel that is configured with the CONFIG_USER_NS option. In some distributions (e.g. Debian) user namespaces must be enabled by writing 1 to /proc/sys/kernel/unprivileged_userns_clone.

SEE ALSO¶

vde_plug(1), cadrop(1), cado(1), capabilities(7)

AUTHORS¶

Renzo Davoli <renzo@cs.unibo.it>, Davide Berardi <berardi.dav@gmail.com>.