How to Use the Command 'unshare' (with Examples)

The unshare command in Unix-like operating systems creates a new process with some aspects of execution environment unshared from the original process. It allows users to execute commands in new user-defined namespaces. These namespaces can isolate various components, such as network interfaces, process IDs, or mount points from the parent process, providing a way to run segregated environments without affecting the host system.

Use Case 1: Execute a Command Without Sharing Access to Connected Networks

Code:

unshare --net command command_arguments

Motivation:

In modern computing environments, especially when dealing with sensitive data or applications, there is a need to minimize exposure and manage permissions tightly. With networks being one of the most common points of vulnerability, isolating a command such that it does not share access to any connected networks becomes crucial. This use case is particularly useful when you need to test network configurations or run network-sensitive applications that should not have access or be accessible via the primary network interfaces.

Explanation:

• unshare: The command used to create namespaces for the subsequent process.
• --net: This option specifies that the network namespace should not be shared with the parent. It effectively provides a new network stack for the command, where no network interfaces or configurations from the parent will be visible. The isolated command can have its own set of network configurations or remain without network connectivity.

Example Output:

In running this command, any network activity performed by command will be isolated and will not affect the main system’s network state. In practical terms, unless a new network is explicitly configured for the command, it will have no network connectivity. Here is a simplified example of the output when running a network check inside this isolated environment:

ping: www.example.com: Temporary failure in name resolution

This error indicates that the network resolution is not available due to the unshared network namespace.

Use Case 2: Execute a Command as a Child Process Without Sharing Mounts, Processes, or Networks

Code:

unshare --mount --pid --net --fork command command_arguments

Motivation:

This use case is useful for creating a highly isolated environment where the command executes with its own mount, process, and network spaces. This is particularly valuable for security-critical operations or when testing software in a controlled environment without risks of interference with the host or other processes. Such isolation prevents the command from being aware of other system processes, accessing existing file systems, or using the host network settings, effectively making it a sandboxed environment.

Explanation:

• unshare: Initiates the command with certain namespaces unshared from the parent.
• --mount: This ensures that the command has its mount namespace, meaning changes to mounts (such as mounting or unmounting filesystems) do not affect the parent process or global system state.
• --pid: Pid namespace isolation means the command will not see any processes from the parent system, only those started within this new namespace. It begins effectively from a PID 1 process perspective.
• --net: Similar to the first use case, ensures the command does not share network configurations with the host.
• --fork: This option runs the command as a child process of the unshare command, ensuring that process isolation is maintained from the moment of creation.

Example Output:

Running a basic ps command within this environment may yield the following:

PID TTY          TIME CMD
  1 pts/0    00:00:00 bash
  7 pts/0    00:00:00 ps

This output shows only the processes visible within the newly created PID namespace, starting with a single shell process. Network checks would be as isolated as in the first example, while mount-related commands will only affect the namespace for this execution, not the broader system.

Conclusion

The unshare command offers powerful capabilities to isolate and control the execution environment of Linux processes. These examples highlight how network and system resource isolation can be used effectively to create more secure and controlled environments for running applications. Whether for security, testing, or development purposes, effectively using unshare can greatly enhance the manageability and security of your computing tasks.