Hacker News Reader

Can't unshare essentially do the same thing?

unshare --map-current-user --root=<new root> <program>

And works completely unprivileged using namespaces.

Be aware that on some distributions such as Debian or RHEL, user namespaces are restricted by default and cannot be used like this from unprivileged user accounts. Although Debian is going to change the default with the next release.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898446

Interesting.

Still, as namespaces gain more and more traction, the value of adding rootless chroot goes down.

If those distros are paranoid about the security implications of user namespaces, then they would certainly apply that reasoning to user chroot.

unshare calls chroot behind the scenes: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.g...

Yes but it does so as the root user in the new user namespace, which is allowed according to existing rules. The change in question is about not requiring root in any user namespace.

Thanks for the link!

In that case, it seems completely arbitrary to not make chroot work as a normal user then.

Reply on news.ycombinator.com