In this lesson, you will learn how to use Mount Namespaces to create a restricted, "jail-like" view of the filesystem for untrusted applications.
While previous lessons focused on managing permissions via ACLs or mandatory access controls like SELinux, those tools regulate access to existing objects. Namespaces take a different approach: they change what the process can see in the first place. By leveraging a Mount Namespace, you can create a private directory tree that hides sensitive system files from an application, effectively isolating it from the rest of your operating system.
Isolating Filesystems with Mount Namespaces
When you spawn a process into a new mount namespace, its mount table becomes independent of the host’s table. This allows you to "re-mount" specific parts of the filesystem. For an untrusted application, you can use unshare to isolate it and then swap its root directory to a restricted folder using pivot_root.
For example, if you have an untrusted binary, you can run it in a private namespace that only sees a minimal set of libraries and configuration files, rather than the entire /etc or /usr directories:
# Create a new mount namespace and run a shell
sudo unshare --mount --fork /bin/bash
# Inside the new namespace, you can re-mount /proc or
# use bind mounts to provide only what the app requires
mount --bind /tmp/safe-app-data /mnt/app-root
Why This Matters for Security
By limiting the filesystem visibility, you reduce the "attack surface." Even if an application is compromised, the attacker cannot see your /home directory, configuration files, or other sensitive system binaries because they simply do not exist within that process's mount namespace. It is a powerful way to implement the principle of least privilege at the infrastructure level rather than the permission level.
While SELinux and AppArmor block access to files, namespaces ensure the application doesn't even know those files exist. When combined with the ACLs you learned about earlier, namespaces provide a robust defense-in-depth strategy for hosting untrusted code.
Key Takeaway: Mount namespaces allow you to construct a restricted filesystem view for untrusted processes, preventing them from seeing or interacting with sensitive system areas beyond their specific needs.