VDENS(1)

NAME
vdens - create a user namespace connected to a vde network

SYNOPSIS
vdens [ options ] [ vde_network [ command [ args ] ] ] vdens -m [ options ] vde_network [ vde_network ... ] [ -- command [ args ] ] vdens --multi [ options ] vde_network [ vde_network ... ] [ -- command [ args ] ]

DESCRIPTION
vdens creates a user namespace with a private network namespace. Vdens launches the command indicated as a parameter ($SHELL if omitted) in a private network namespace. If the vde_network parameter is present (and it does not match one of the strings "-" or "no") the virtual private network namespace will have a virtual interface connected to the specified vde network. Vdens grants the capabilities CAP_NET_BIND_SERVICE, CAP_NET_BROADCAST, CAP_NET_ADMIN and CAP_NET_RAW to the command to permit the configuration of the virtual interface. The scope of these capabilities is limited to the user namespace created by vdens. Once the network has been configured, the capabilities can be dropped (e.g. using csdrop(1)) in order to increase the security (obeying to the principle of least privilege).

OPTIONS
OPTIONS vdens accepts the following options.

-m
--multi
    connect the vde namespace to one or more vde networks. A virtual interface is defined for each vde_network: vde0 is connected to the first vde_network, vde1 is connected to the second and so on. (It is possible to use a different prefix for the interface names instead of "vde", see -i or --iface below).

-i  interface_prefix
--iface  interface_prefix
    define the prefix of the interface name. For example use --iface eth to name the interfaces "eth0", "eth1", etc. (the default value is "vde")

-R  ip_addr(s)
--resolvaddr  ip_addr(s)
    define the address (or addresses) of the domain name servers for the namespace. (multiple IPv4 or IPv6 addresses can be separated by commas, e.g. "-R 9.9.9.9,9.9.8.8")

-H  hostname
--hostname  hostname
    define the hostname for the namespace.

-r  pathname
--resolvconf  pathname
    define the pathname of the file which will appear as /etc/config.sys in the user namespace. (it is ignored if used together with -R or --resolvaddr)

-s
--sysadm
    grant also CAP_SYS_ADMIN in the namespace so that it is possible to bind mount files and directories.

-c
--clone
    Use clone(2) to create the private network namespace. Vdens needs one more thread to manage the vde communication.

-u
--unshare
    Use unshare(2) to create the private network namespace. It may not work if the vde plugin in use is multithreaded (e.g. slirp). If neither -c/--clone nor -u/--unshare is set, vdens tries unshare first and then it uses clone if unshare fails. (If both are set vdens uses clone).

ENVIRONMENT VARIABLES

VDE_RESOLVCONF
    define the default value for the --resolvconf option

VDE_RESOLVADDR
    define the default value for the --resolvaddr option

NOTES
Use of user namespaces requires a kernel that is configured with the CONFIG_USER_NS option. In some distributions (e.g. Debian) user namespaces must be enabled by writing 1 to /proc/sys/kernel/unprivileged_userns_clone.

SEE ALSO
vde_plug(1), cadrop(1), cado(1), capabilities(7)

AUTHORS
Renzo Davoli <renzo@cs.unibo.it>, Davide Berardi <berardi.dav@gmail.com>.