{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
A UTS (UNIX Time-Sharing System) namespace is a Linux kernel feature that provides isolation of two system identifiers: the hostname and the NIS (Network Information Service) domain name. This isolation allows each UTS namespace to have its own independent hostname and NIS domain name, which is particularly useful in containerization scenarios where each container should appear as a separate system with its own hostname.
- When a new UTS namespace is created, it starts with a copy of the hostname and NIS domain name from its parent namespace. This means that, at creation, the new namespace shares the same identifiers as its parent. However, any subsequent changes to the hostname or NIS domain name within the namespace will not affect other namespaces.
- Processes within a UTS namespace can change the hostname and NIS domain name using the
sethostname()
andsetdomainname()
system calls, respectively. These changes are local to the namespace and do not affect other namespaces or the host system. - Processes can move between namespaces using the
setns()
system call or create new namespaces using theunshare()
orclone()
system calls with theCLONE_NEWUTS
flag. When a process moves to a new namespace or creates one, it will start using the hostname and NIS domain name associated with that namespace.
sudo unshare -u [--mount-proc] /bin/bash
By mounting a new instance of the /proc
filesystem if you use the param --mount-proc
, you ensure that the new mount namespace has an accurate and isolated view of the process information specific to that namespace.
Error: bash: fork: Cannot allocate memory
When unshare
is executed without the -f
option, an error is encountered due to the way Linux handles new PID (Process ID) namespaces. The key details and the solution are outlined below:
-
Problem Explanation:
- The Linux kernel allows a process to create new namespaces using the
unshare
system call. However, the process that initiates the creation of a new PID namespace (referred to as the "unshare" process) does not enter the new namespace; only its child processes do. - Running
%unshare -p /bin/bash%
starts/bin/bash
in the same process asunshare
. Consequently,/bin/bash
and its child processes are in the original PID namespace. - The first child process of
/bin/bash
in the new namespace becomes PID 1. When this process exits, it triggers the cleanup of the namespace if there are no other processes, as PID 1 has the special role of adopting orphan processes. The Linux kernel will then disable PID allocation in that namespace.
- The Linux kernel allows a process to create new namespaces using the
-
Consequence:
- The exit of PID 1 in a new namespace leads to the cleaning of the
PIDNS_HASH_ADDING
flag. This results in thealloc_pid
function failing to allocate a new PID when creating a new process, producing the "Cannot allocate memory" error.
- The exit of PID 1 in a new namespace leads to the cleaning of the
-
Solution:
- The issue can be resolved by using the
-f
option withunshare
. This option makesunshare
fork a new process after creating the new PID namespace. - Executing
%unshare -fp /bin/bash%
ensures that theunshare
command itself becomes PID 1 in the new namespace./bin/bash
and its child processes are then safely contained within this new namespace, preventing the premature exit of PID 1 and allowing normal PID allocation.
- The issue can be resolved by using the
By ensuring that unshare
runs with the -f
flag, the new PID namespace is correctly maintained, allowing /bin/bash
and its sub-processes to operate without encountering the memory allocation error.
docker run -ti --name ubuntu1 -v /usr:/ubuntu1 ubuntu bash
ls -l /proc/self/ns/uts
lrwxrwxrwx 1 root root 0 Apr 4 20:49 /proc/self/ns/uts -> 'uts:[4026531838]'
{% code overflow="wrap" %}
sudo find /proc -maxdepth 3 -type l -name uts -exec readlink {} \; 2>/dev/null | sort -u
# Find the processes with an specific namespace
sudo find /proc -maxdepth 3 -type l -name uts -exec ls -l {} \; 2>/dev/null | grep <ns-number>
{% endcode %}
{% hint style="success" %}
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
<details>
<summary>Support HackTricks</summary>
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}
</details>
{% endhint %}