userns-check

Overview ¶

Detects whether user namespaces are restricted by checking if getsockopt(SO_TYPE) returns EACCES when a unix socket fd is inherited by a child spawned with CLONE_NEWUSER + a UID mapping + exec.

This reproduces the exact failure path in the nerdbox shim where net.FileListener calls getsockopt(fd, SOL_SOCKET, SO_TYPE) and gets EACCES.

The exec is critical: it triggers capability recomputation. With euid != 0 in the new userns, caps drop to zero, and cross-userns socket access fails.

Exit codes:

0  — userns NOT restricted (getsockopt succeeded)
1  — userns RESTRICTED (getsockopt got EACCES/EPERM)
2  — unexpected error
77 — skipped (running as root)