setns(2) System Calls Manual setns(2) setns - (libc -lc) #define _GNU_SOURCE /* feature_test_macros(7) */ #include int setns(int fd, int nstype); setns() . fd : o /proc/pid/ns/ ( ); o PID ( pidfd_open(2)). nstype . fd /proc/pid/ns/ fd /proc/pid/ns/ setns() nstype. setns() . nstype . : 0 . CLONE_NEWCGROUP ( 4.6) fd cgroup. CLONE_NEWIPC ( Linux 3.0) fd IPC. CLONE_NEWNET ( Linux 3.0) fd . CLONE_NEWNS ( Linux 3.8) fd . CLONE_NEWPID ( 3.8) fd PID . CLONE_NEWTIME ( Linux 5.8) fd . CLONE_NEWUSER ( 3.8) fd . CLONE_NEWUTS ( Linux 3.0) fd UTS. nstype 0 ( ) fd. nstype fd . ( fd UNIX.) fd PID Linux 5.8 fd PID pidfd_open(2) clone(2). setns() fd. nstype OR CLONE_NEW* . nstype . UTS PID 1234 : int fd = pidfd_open(1234, 0); setns(fd, CLONE_NEWUSER | CLONE_NEWNET | CLONE_NEWUTS); : CAP_SYS_ADMIN . ( .) . setns(). setns() . setns(). ( clone(2) CLONE_FS) . user_namespaces(7). CAP_SYS_CHROOT CAP_SYS_ADMIN CAP_SYS_ADMIN . ( clone(2) CLONE_FS) . user_namespaces(7) . PID PID CAP_SYS_ADMIN PID . PID . PID PID PID . PID PID ( ) PID . PID pid_namespaces(7). Cgroup cgroup CAP_SYS_ADMIN cgroup . setns() cgroup cgroup . CAP_SYS_ADMIN . setns(). IPC UTS IPC UTS CAP_SYS_ADMIN . setns() 0. -1 errno . EBADF fd . EINVAL fd nstype. EINVAL . EINVAL PID ( ). EINVAL . EINVAL (CLONE_FS) ( ) . EINVAL . EINVAL fd PID nstype ( 0). ENOMEM . EPERM . ESRCH fd PID ( ). . 3.0 glibc 2.14. /proc/pid/ns/ namespaces(7). clone(2) setns(). . /proc/pid/ns/ . . setns() . ( ns_exec) CLONE_NEWUTS clone(2) ( newuts). clone(2) . UTS . UTS . $ su; # Need privilege for namespace operations Password: # ./newuts bizarro & [1] 3549 clone() returned 3550 uts.nodename in child: bizarro uts.nodename in parent: antero # uname -n; # Verify hostname in the shell antero . : # ./ns_exec /proc/3550/ns/uts /bin/bash; # uname -n; # Executed in shell started by ns_exec bizarro #define _GNU_SOURCE #include #include #include #include #include #include int main(int argc, char *argv[]) { int fd; if (argc < 3) { fprintf(stderr, "%s /proc/PID/ns/FILE cmd args...\n", argv[0]); exit(EXIT_FAILURE); } /* Get file descriptor for namespace; the file descriptor is opened with O_CLOEXEC so as to ensure that it is not inherited by the program that is later executed. */ fd = open(argv[1], O_RDONLY | O_CLOEXEC); if (fd == -1) err(EXIT_FAILURE, "open"); if (setns(fd, 0) == -1) /* Join that namespace */ err(EXIT_FAILURE, "setns"); execvp(argv[2], &argv[2]); /* Execute a command in namespace */ err(EXIT_FAILURE, "execvp"); } nsenter(1), clone(2), fork(2), unshare(2), vfork(2), namespaces(7), unix(7) 3 . . : . 6.18 8 2026 setns(2)