title: How to test user namespace with clone system call with CLONE_NEWUSER flag
body: <p>Testing the <a href="https://github.com/PacktPublishing/Containerization-with-LXC/blob/master/Chapter01/user_namespace.c" rel="nofollow noreferrer">sample</a> from <a href="https://rads.stackoverflow.com/amzn/click/com/1785888943" rel="nofollow noreferrer" rel="nofollow noreferrer">Containerization with LXC</a> to demonstrate User namespace.</p>
  
  <p>It is supposed to print both outputs from the child process in a new user namespace and outputs from the parent process.</p>
  
  <pre><code># ./user_namespace
  UID outside the namespace is 0
  GID outside the namespace is 0
  UID inside the namespace is 65534
  GID inside the namespace is 65534
  </code></pre>
  
  <p>However, it only show parent outputs.</p>
  
  <pre><code>UID outside the namespace is 1000
  GID outside the namespace is 1000
  </code></pre>
  
  <p>Please help to understand why the child process is not printing.</p>
  
  <h3><a href="https://github.com/PacktPublishing/Containerization-with-LXC/blob/master/Chapter01/user_namespace.c" rel="nofollow noreferrer">Code</a></h3>
  
  <pre><code>#define _GNU_SOURCE
  #include &lt;stdio.h&gt;
  #include &lt;unistd.h&gt;
  #include &lt;stdlib.h&gt;
  #include &lt;sched.h&gt;
  #include &lt;signal.h&gt;
  
  static int childFunc(void *arg)
  {
      printf("UID inside the namespace is %ld\n", (long)geteuid());
      printf("GID inside the namespace is %ld\n", (long)getegid());
  }
  
  static char child_stack[1024*1024];
  
  int main(int argc, char *argv[])
  {
      pid_t child_pid;
  
      /* child_pid = clone(childFunc, child_stack + (1024*1024), CLONE_NEWUSER, 0);*/
  
      child_pid = clone(&amp;childFunc, child_stack + (1024*1024), CLONE_NEWUSER, 0);
  
      printf("UID outside the namespace is %ld\n", (long)geteuid());
      printf("GID outside the namespace is %ld\n", (long)getegid());
      waitpid(child_pid, NULL, 0);
      exit(EXIT_SUCCESS);
  }
  </code></pre>
  
  <h3>Environment</h3>
  
  <pre><code>$ uname -r
  3.10.0-693.21.1.el7.x86_64
  
  $ cat /etc/os-release 
  NAME="CentOS Linux"
  VERSION="7 (Core)"
  ID="centos"
  ID_LIKE="rhel fedora"
  VERSION_ID="7"
  PRETTY_NAME="CentOS Linux 7 (Core)"
  CPE_NAME="cpe:/o:centos:centos:7"
  </code></pre>
  
  <h3>References</h3>
  
  <ul>
  <li><a href="https://stackoverflow.com/questions/23752264/how-to-use-clone-to-make-parent-process-and-child-process-run-at-the-same-time">How to use clone() to make parent process and child process run at the same time?</a></li>
  <li><a href="http://man7.org/linux/man-pages/man2/clone.2.html" rel="nofollow noreferrer">man clone</a></li>
  </ul>
  
  <hr>
  
  <h3>Update</h3>
  
  <p>As per the answer from thejonny, it was to enable user namespace. For RHEL/CentOS 7, <a href="https://superuser.com/questions/1294215/is-it-safe-to-enable-user-namespaces-in-centos-7-4-and-how-to-do-it">Is it safe to enable user namespaces in CentOS 7.4 and how to do it?</a></p>
  
  <ul>
  <li><a href="https://access.redhat.com/solutions/3188102" rel="nofollow noreferrer">User namespaces no longer work in RHEL 7.4</a></li>
  </ul>
  
  <blockquote>
    <p>By default, the new 7.4 kernel restricts the number of user namespaces to 0. To work around this, increase the user namespace limit:<br>
    echo 15000 > /proc/sys/user/max_user_namespaces</p>
  </blockquote>