title: clone: operation not permitted
body: <p>I am using <a href="https://github.com/cms-dev/isolate" rel="noreferrer">isolate</a>, an isolator to isolate the execution of another program using Linux Containers. It's very handy and it works very well locally on my computer (I can run fork bombs and infinite loops and it protects everything).</p>
  
  <p>Now I'm trying to get this to work on an Ubuntu 12.04 server I have, but I'm having some difficulties with it. It's a fresh server too.</p>
  
  <p>When I run:</p>
  
  <p><code>sudo isolate --run -- mycommand</code></p>
  
  <p>(<code>mycommand</code> I usually try <code>python3</code> or something), I get:</p>
  
  <p><code>clone: Operation not permitted</code></p>
  
  <p>So, I dug up on the clone function (called like this in <code>isolate.c</code>):</p>
  
  <pre><code>box_pid = clone(
    box_inside,           // Function to execute as the body of the new process
    argv,         // Pass our stack
    SIGCHLD | CLONE_NEWIPC | CLONE_NEWNET | CLONE_NEWNS | CLONE_NEWPID,
    argv);            // Pass the arguments
  if (box_pid &lt; 0)
    die("clone: %m");
  if (!box_pid)
    die("clone returned 0");
  box_keeper();
  </code></pre>
  
  <p>Here's the Return Value of the function <code>clone</code>:</p>
  
  <blockquote>
    <p>On success, the thread ID of the child process is returned in the caller's thread of execution. On failure, -1 is returned in the caller's context, no child process will be created, and errno will be set appropriately.</p>
  </blockquote>
  
  <p>And this is the error I'm getting:</p>
  
  <blockquote>
    <p>EPERM           Operation not permitted (POSIX.1)</p>
  </blockquote>
  
  <p>And then I also found this:</p>
  
  <blockquote>
    <p>EPERM    CLONE_NEWNS was specified by a non-root process (process without CAP_SYS_ADMIN).</p>
  </blockquote>
  
  <p>The <code>clone</code> function is indeed passing <code>CLONE_NEWNS</code> to run the program in a new namespace. I actually tried removing but I keep getting <code>clone: Operation not permitted</code>.</p>
  
  <p>So, it all seems to point out to not having root privileges, but I actually ran the command as <code>root</code> (with and without <code>sudo</code> just to be sure), and also with a normal user in the sudoers group. None of that worked, but it works very well locally. Root privileges work for everything else but for some reason when I run this <code>isolate</code> program, it doesn't work.</p>
  
  <p>I tried both with <code>isolate</code> in <code>/usr/bin</code> and running <code>./isolate</code> in a local folder too.</p>