mirror of
https://github.com/systemd/systemd.git
synced 2026-08-12 22:17:19 +00:00
d35fa257eb
When both --private-users and --network-namespace-path are specified, systemd-nspawn fails to start with "Operation not permitted" during the setns() call. This occurs because of the following execution sequence: 1. The outer child calls raw_clone() with CLONE_NEWUSER to create the new user namespace. 2. The inner child is spawned inside this new user namespace. 3. The inner child then attempts to call setns() to join the external network namespace. Because the inner child is already running inside the restricted user namespace, the kernel rejects the setns() call to join a network namespace owned by a different (host/more privileged) user namespace. Fix this by moving the setns() call to the outer child, executing it just before the raw_clone() call. This ensures the network namespace is joined while the process still has the necessary privileges, which also aligns with the inner child's expectation that the network namespace is already set up upon entry.