unshare(2) System Calls Manual unshare(2) unshare - (libc -lc) #define _GNU_SOURCE #include int unshare(int flags); unshare() ( ) ( ) . fork(2) vfork(2) clone(2). unshare() . flags . (OR) : CLONE_FILES clone(2) CLONE_FILES. . CLONE_FS clone(2) CLONE_FS. (chroot(2)) (chdir(2)) umask (umask(2)) . CLONE_NEWCGROUP ( 4.6) clone(2) CLONE_NEWCGROUP. cgroup. CLONE_NEWCGROUP CAP_SYS_ADMIN. CLONE_NEWIPC ( 2.6.19) clone(2) CLONE_NEWIPC. IPC IPC . CLONE_SYSVSEM . CLONE_NEWIPC CAP_SYS_ADMIN. CLONE_NEWNET ( 2.6.24) clone(2) CLONE_NEWNET. . CLONE_NEWNET CAP_SYS_ADMIN. CLONE_NEWNS clone(2) CLONE_NEWNS. . CLONE_FS . CLONE_NEWNS CAP_SYS_ADMIN. mount_namespaces(7). CLONE_NEWPID ( 3.8) clone(2) CLONE_NEWPID. PID PID . . 1 init(1) . CLONE_NEWPID CLONE_THREAD . CLONE_NEWPID CAP_SYS_ADMIN. pid_namespaces(7). CLONE_NEWTIME ( Linux 5.6) . . CLONE_NEWTIME CAP_SYS_ADMIN. time_namespaces(7). CLONE_NEWUSER ( 3.8) clone(2) CLONE_NEWUSER. . clone(2) CLONE_NEWUSER . CLONE_NEWUSER CLONE_NEWUSER CLONE_THREAD. Linux 3.9 CLONE_NEWUSER CLONE_FS. CLONE_NEWUSER . user_namespaces(7). CLONE_NEWUTS ( 2.6.19) clone(2) CLONE_NEWUTS. UTS IPC UTS . CLONE_NEWUTS CAP_SYS_ADMIN. CLONE_SYSVSEM ( Linux 2.6.26) clone(2) CLONE_SYSVSEM. System V (semadj) semadj . semadj semop(2). CLONE_THREAD CLONE_SIGHAND CLONE_VM flags ( ). . ( CLONE_THREAD CLONE_VM CLONE_VM CLONE_SIGHAND.) . flags unshare() . . -1 errno . EINVAL flags. EINVAL CLONE_THREAD CLONE_SIGHAND CLONE_VM flags . EINVAL CLONE_NEWIPC flags CONFIG_SYSVIPC CONFIG_IPC_NS. EINVAL CLONE_NEWNET flags CONFIG_NET_NS. EINVAL CLONE_NEWPID flags CONFIG_PID_NS. EINVAL CLONE_NEWUSER flags CONFIG_USER_NS. EINVAL CLONE_NEWUTS flags CONFIG_UTS_NS. EINVAL CLONE_NEWPID flags unshare() CLONE_NEWPID. ENOMEM . ENOSPC ( 3.7) CLONE_NEWPID PID pid_namespaces(7). ENOSPC ( 4.9 EUSERS) CLONE_NEWUSER flags . user_namespaces(7). 3.11 4.8 EUSERS. ENOSPC ( 4.9) flags /proc/sys/user. namespaces(7). EPERM . EPERM CLONE_NEWUSER flags ( user_namespaces(7)). EPERM ( 3.9) CLONE_NEWUSER flags chroot ( ). EUSERS ( 3.11 4.8) CLONE_NEWUSER flags . ENOSPC . . 2.6.16. clone(2) unshare(). 3.8 unshare() CLONE_SIGHAND CLONE_THREAD CLONE_VM. . CAP_SYS_ADMIN. unshare() CAP_SYS_ADMIN . unshare(1) . : $ readlink /proc/$$/ns/mnt; mnt:[4026531840] $ sudo ./unshare -m /bin/bash; # readlink /proc/$$/ns/mnt; mnt:[4026532325] readlink(1) . /* unshare.c A simple implementation of the unshare(1) command: unshare namespaces and execute a command. */ #define _GNU_SOURCE #include #include #include #include #include static void usage(char *pname) { fprintf(stderr, "Usage: %s [options] program [arg...]\n", pname); fprintf(stderr, "Options can be:\n"); fprintf(stderr, " -C unshare cgroup namespace\n"); fprintf(stderr, " -i unshare IPC namespace\n"); fprintf(stderr, " -m unshare mount namespace\n"); fprintf(stderr, " -n unshare network namespace\n"); fprintf(stderr, " -p unshare PID namespace\n"); fprintf(stderr, " -t unshare time namespace\n"); fprintf(stderr, " -u unshare UTS namespace\n"); fprintf(stderr, " -U unshare user namespace\n"); exit(EXIT_FAILURE); } int main(int argc, char *argv[]) { int flags, opt; flags = 0; while ((opt = getopt(argc, argv, "CimnptuU")) != -1) { switch (opt) { case 'C': flags |= CLONE_NEWCGROUP; break; case 'i': flags |= CLONE_NEWIPC; break; case 'm': flags |= CLONE_NEWNS; break; case 'n': flags |= CLONE_NEWNET; break; case 'p': flags |= CLONE_NEWPID; break; case 't': flags |= CLONE_NEWTIME; break; case 'u': flags |= CLONE_NEWUTS; break; case 'U': flags |= CLONE_NEWUSER; break; default: usage(argv[0]); } } if (optind >= argc) usage(argv[0]); if (unshare(flags) == -1) err(EXIT_FAILURE, "unshare"); execvp(argv[optind], &argv[optind]); err(EXIT_FAILURE, "execvp"); } unshare(1), clone(2), fork(2), kcmp(2), setns(2), vfork(2), namespaces(7) Documentation/userspace-api/unshare.rst 3 . . : . 6.18 8 2026 unshare(2)