Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to have different mounts that are seen only by a specific process or user. One use case I am thinking about is when I want to mount a unionfs or aufs that will be available for one user. So I can have multiple mounts on the same mount point that are different for different users.

share|improve this question
I don't care to look it up right now, but I think the pam_namespace can do this...also something with cgroups should be possible but I haven't done this yet. – Server Horror Nov 3 '11 at 22:22
Awesome. Please make it an answer so I can accept it. – Mircea Vutcovici Nov 4 '11 at 13:28
Based on your answer I've found an article about mount namespaces:… and the man page: – Mircea Vutcovici Nov 4 '11 at 13:30
I don't consider that info much of an answer. But If you provide some outline on how to do it I'll upvote yours. Answering your own question seems perfectly fine to me (and I still don't have to look it up) :) – Server Horror Nov 9 '11 at 14:00
up vote 2 down vote accepted

Here is how to enable per user mount namespaces in Ubuntu 12.10 using pam_namespace:

Edit /etc/security/namespace.conf

Uncomment the last lines. For safety, add your current user to the list of exclusions.

/tmp     /tmp-inst/            level      root,adm,myuser
/var/tmp /var/tmp/tmp-inst/     level      root,adm,myuser

Edit /etc/security/namespace.init and change #!/bin/sh -p to #!/bin/bash --noprofile or to #!/bin/sh This is because sh is actually dash.

For testing edit /etc/pam.d/su and append at the end of file:

session required

Test on a test user:

su - testuser

As test user run:

echo diff '<(sort /proc/'$$'/mounts) <(sort /proc/mounts)'

This will generate a command like:

diff <(sort /proc/31987/mounts) <(sort /proc/mounts)

Run the generated diff from test user shell and from root. From the test user you will have no output, but from the root you will see something like:

< /dev/sda1 /tmp ext4 rw,relatime,errors=remount-ro,data=ordered 0 0
< /dev/sda1 /tmp/tmp-inst ext4 rw,relatime,errors=remount-ro,data=ordered 0 0
< /dev/sda1 /var/tmp ext4 rw,relatime,errors=remount-ro,data=ordered 0 0
< /dev/sda1 /var/tmp/tmp-inst ext4 rw,relatime,errors=remount-ro,data=ordered 0 0

The test_user /tmp folder will be mapped as /tmp/tmp-inst/test_user and it will be accessible only to this user.

share|improve this answer

Why not just mount at ~/specificmountpoint. Set the permissions accordingly. Every user will have the same (almost) mout point.

share|improve this answer

It looks like nowadays it's possible:

  1. You should create new User Namespace, which gives your process root permissions and all capabilities (only inside that namespace).
  2. You should create new Mount Namespace, to isolate mounts inside your namespace from global mounts.
  3. Mount what you need.
  4. Drop privileges back to normal user and run your application.

At least, in theory. Check this article for more details:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.