Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a php script, say file.php that contains:

<?php
exec("ip netns exec vpn file2.php");
?>

If I run file.php via the command line, as root, it works. However, when I run it via apache, www-data doesn't have the permissions to use ip netns exec, however, www-data can use ip netns list.

How do I either a) let ip netns exec be run by non root users, or give www-data the permissions to run ip net exec stuff?

share|improve this question

1 Answer 1

Try something like

# ip netns exec vpn sudo -u www-data apache

as root .

This way apache will run with netns as non-root user . If you need both namespaces at the same time , start two instances , each in one namespace . Changing namespace on-the-fly doesn't seem to work .

Explaination :

Directory /var/run/netns stores all network namespaces , when we add a new one "abc" , empty file "abc" is created in this directory . Every time we execute program "xyz" in namespace "abc" , ip(1) opens and holds a file descriptor for /var/run/netns/abc , then calls unshare(2) and setns(2) .

So here comes the two barriers . One is the filesystem permissions of /var/run/netns/* , the other is capabilities for privileged syscalls .

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.