1

I have a php script, say file.php that contains:

<?php
exec("ip netns exec vpn file2.php");
?>

If I run file.php via the command line, as root, it works. However, when I run it via apache, www-data doesn't have the permissions to use ip netns exec, however, www-data can use ip netns list.

How do I either a) let ip netns exec be run by non root users, or give www-data the permissions to run ip net exec stuff?

1 Answer 1

1

Try something like

# ip netns exec vpn sudo -u www-data apache

as root .

This way apache will run with netns as non-root user . If you need both namespaces at the same time , start two instances , each in one namespace . Changing namespace on-the-fly doesn't seem to work .

Explaination :

Directory /var/run/netns stores all network namespaces , when we add a new one "abc" , empty file "abc" is created in this directory . Every time we execute program "xyz" in namespace "abc" , ip(1) opens and holds a file descriptor for /var/run/netns/abc , then calls unshare(2) and setns(2) .

So here comes the two barriers . One is the filesystem permissions of /var/run/netns/* , the other is capabilities for privileged syscalls .

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .