nscreate**
               $ **getcap nscreate** # Verify capabilities of local nscreate
               nscreate = cap_setgid,cap_setuid+ep
               $ **cp $(which getpcaps) .**
               $ **chmod u+s getpcaps**
               $ **ls -ln getpcaps** # Verify ownership and permissions
               -rwsr-xr-x. 1 1000 1000 15992 Jun 10 08:24 getpcaps
               $ **./nscreate -U --uid-map='0 1000 10' --gid-map='0 1000 10' \**
                               **--setuid 1 ./getpcaps 0**
               Capabilities for `0': =ep
    
           Looking at the above output, we see that the process running **getpcaps**
           has all capabilities (inside the user namespace).  This happened
           because the set-user-ID **getpcaps** executable caused the process's user
           ID to switch to 1000, which is equivalent to 0 inside the user namesâ
           pace, and as a result the process gained all permitted and effective
           capabilities.
    

##  AUTHORS  top

    
    
           Michael Kerrisk â¨mtk.manpages@gmail.comâ©
    

##  SEE ALSO  top

    
    
           **findmnt**(1), [nsenter(1)](../man1/nsenter.1.html), [setpriv(1)](../man1/setpriv.1.html), [unshare(1)](../man1/unshare.1.html), [clone(2)](../man2/clone.2.html), [unshare(2)](../man2/unshare.2.html),
           [namespaces(7)](../man7/namespaces.7.html), [mount(8)](../man8/mount.8.html)
    

##  COLOPHON  top

    
    
           This page is part of the _util-linux_ (a random collection of Linux
           utilities) project.  Information about the project can be found at 
           â¨<https://www.kernel.org/pub/linux/utils/util-linux/>â©.  If you have a
           bug report for this manual page, send it to
           util-linux@vger.kernel.org.  This page was obtained from the
           project's upstream Git repository
           â¨git://git.kernel.org/pub/scm/utils/util-linux/util-linux.gitâ© on
           2020-07-14.  (At that time, the date of the most recent commit that
           was found in the repository was 2020-07-14.)  If you discover any
           rendering problems in this HTML version of the page, or you believe
           there is a better or more up-to-date source for the page, or you have
           corrections or improvements to the information in this COLOPHON
           (which is _not_ part of the original manual page), send a mail to
           man-pages@man7.org
    
    secisol-tools                    2020-07-01                      NSCREATE(1)
    

* * *

* * *

HTML rendering created 2020-07-14 by [ Michael Kerrisk ](https://man7.org/mtk/index.html) , author of [ _The Linux Programming Interface_ ](https://man7.org/tlpi/) , maintainer of the [ Linux _man-pages_ project ](https://www.kernel.org/doc/man-pages/) .  For details of in-depth **Linux/UNIX system programming training courses** that I teach, look [ here ](https://man7.org/training/) .  Hosting by [ jambit GmbH ](https://www.jambit.com/index_en.html) .  [ ![Valid XHTML 1.1](https://www.w3.org/Icons/valid-xhtml11) ](https://validator.w3.org/check?uri=referer) |  |  [ ![Cover of TLPI](https://man7.org/tlpi/cover/TLPI-front-cover-vsmall.png) ](https://man7.org/tlpi/)  
---|---|---  
  
* * *

[ ![Web Analytics Made Easy -

StatCounter](https://c.statcounter.com/7422636/0/9b6714ff/1/)
](https://statcounter.com/ "Web Analytics

Made Easy - StatCounter")