clone: Operation not permitted when creating user namespace in rootless Podman

Immediate Answer

Rootless Podman fails with clone: Operation not permitted when the kernel either blocks unprivileged namespace creation ( kernel.unprivileged_userns_clone=0 ), the per‑user namespace limit is exhausted, or AppArmor forbids the binary from creating a user namespace. Enabling kernel.unprivileged_userns_clone=1 globally widens the attack surface for local privilege escalation, but it restores the most straightforward rootless workflow. Administrators can keep the kernel knob at 0 and rely on newuidmap/newgidmap helpers (setuid binaries) to provide equivalent isolation, provided the helpers have the setuid bit set and the /etc/subuid and /etc/subgid files are correctly configured.

Security Trade‑offs of Global Enablement

• Attack surface: Unprivileged users can create namespaces that exercise kernel code paths not exercised by privileged users, potentially exposing LPE vulnerabilities.
• Isolation quality: Namespace creation is still isolated; the main risk is that a compromised namespace can be used to escape to the host if a kernel bug is present.
• Operational simplicity: All users can run podman run without additional UID mapping configuration.

Verifying Setuid Helpers Provide Equivalent Isolation

1. Check that the helpers are setuid:

   ls -l /usr/bin/newuidmap /usr/bin/newgidmap
   # Expected: -rwsr-xr-x 1 root root …
   

2. Verify the sub‑UID/GID ranges exist for the user:

   grep ^$(id -un): /etc/subuid
   grep ^$(id -un): /etc/subgid
   

3. Run a test container as the user and inspect the namespace mapping:

   podman run --rm -ti --entrypoint sh alpine -c "id; ls -l /proc/self/ns/user"
   # You should see a non‑root UID and a distinct user namespace link.
   

4. Confirm no AppArmor denials in the log:

   journalctl -k | grep -i apparmor | grep userns_create
   

A Practical Policy for Multi‑User Systems

• Keep kernel.unprivileged_userns_clone=0 to minimise kernel exposure.
• Set a per‑user namespace limit that balances usability with safety:

  sysctl -w user.max_user_namespaces=64
  # Persist in /etc/sysctl.d/99-userns.conf
  

• Whitelist trusted runtimes in AppArmor (e.g., Podman, Bwrap) so they can create namespaces even when the global binary toggle is off. Example profile snippet:

  profile podman {
    capability setuid,
    capability setgid,
    /usr/bin/podman mr,
    /usr/bin/newuidmap mr,
    /usr/bin/newgidmap mr,
    /etc/subuid r,
    /etc/subgid r,
    /usr/share/podman/* r,
  }
  

• Audit /etc/subuid and /etc/subgid regularly to ensure ranges are not over‑committed.
• Use podman system reset --rootless to clean stale namespace entries if a user’s namespace quota is exhausted.

Next Diagnostic Step

Could you confirm the current value of user.max_user_namespaces on the target system? This will determine whether the per‑user limit is the cause of the clone failure and whether the policy above needs tightening.