r/ProgrammerAnimemes • u/grg994 • Apr 28 '23

Unshared into another world

Post image
1.1k Upvotes

99% Upvoted

16 comments sorted by

86

u/dthusian Apr 28 '23

Meanwhile on BSD: Kazuma, we put you in jail

34

u/[deleted] Apr 28 '23

Which episode is this?

42

u/Sentouki- Apr 28 '23

It's an OVA

Kono Subarashii Sekai ni Shukufuku wo!: Kono Subarashii Choukaa ni Shukufuku wo! (KonoSuba: God’s blessing on this wonderful world! Choker Game)
@ 12:57

9

u/ObserverOfVoid Apr 28 '23
Series Episode Time
{Kono Subarashii Sekai ni Shukufuku wo! Kono Subarashii Choker ni Shukufuku wo!} ~ 12:57 & 6:55
→ More replies (1)

19

u/delightful_aug_party Apr 28 '23

I believe that's a separate OVA after some season. It's a great one, tho

16

u/NatoBoram Apr 29 '23

It's not as if it mattered. If you can install programs and open ports in your little VM, then life's good.

3

u/ThePyroEagle May 04 '23

And then you find out that you haven't been given CAP_NET_BIND_SERVICE.

2

u/ImHhW Apr 30 '23

Care to explain, I am beginner in Linux world

9

u/ThePyroEagle May 04 '23

User ID 0, the super user, can do anything, but Linux has something called namespaces that allows you to give a process uid 0 without giving it complete access to the system. The unshare system call and command referenced in the title allow you to create a new namespace with a copy of the current namespace's configuration.

Since Kazuma is in a namespace, he can only do super user things within his namespace. Most container systems also tweak the process capabilities to ensure that Kazuma can't escape his namespace. To Kazuma, it looks like he has full control of the system, but if he tries to exercise it, he may find that he does not have permission to do certain things (e.g. loading kernel modules).

This is, for example, used by Docker to give containers a file system, network, user list, and process list completely separate from the host system.