title: Why unshare(CLONE_NEWNET) requires CAP_SYS_ADMIN?
body: <p>I'm playing with linux namespaces and I've noticed that if a user wants to execute a process in a new network namespace (without using user namespaces) he needs to be root or have the <code>CAP_SYS_ADMIN</code> capability.</p>
  <p>The <a href="http://linux.die.net/man/2/unshare" rel="noreferrer">unshare(2)</a> manpage says:</p>
  <blockquote>
  <p>CLONE_NEWNET (since Linux 2.6.24)</p>
  <p>This  flag  has the same effect as the clone(2) CLONE_NEWNET flag.
  Unshare the network namespace, so that the calling process is moved into a new net‐work namespace which is not shared with any previously existing process.  Use of CLONE_NEWNET requires the CAP_SYS_ADMIN capability.</p>
  </blockquote>
  <p>So, if I want to execute a pdf reader in a network sandbox I must use user-net-namespaces or some privileged wrapper.</p>
  <p>Why?  The new process will be placed in a new network namespace with no interfaces, so it will be isolated from the real network, right?  Which kind of problems/security threats do unprivileged non user network namespaces raise?</p>