lsns tips — authorized namespace literacy

Snapshot

Tip checklist (authorized only)

1. Confirm you may run lsns on the lab host (syllabus box you own or were given access to).
2. Prefer documenting who / why / ticket before any deep process/namespace walk — never poke production without change control.
3. Record short factual notes; quote short Evidence (NS type, NPROCS, NSFS path labels — never secrets or foreign PIDs you should not see).
4. Optional: enter peer → nsenter-tips.
5. Optional: create/unshare peer → unshare-tips.
6. Prefer disposable lab containers/VMs for lsns drills; quote lsns -t net / lsns -t mnt afterward as Evidence.
7. Prefer read-only lsns / lsns -J (JSON when available) for most Evidence binders — avoid inventing escape cookbooks.
8. Stop at literacy — no attack or unauthorized namespace-escape cookbooks.

Allowed framing

• Classroom labs reviewing lsns / lsns -t pid/net/mnt/user/cgroup/ipc/uts on authorized disposable hosts.
• Binding short factual notes as Evidence (NS type/NPROCS/NSFS — no secrets).
• Documenting expected vs observed namespace inventory for authorized inventory notes.
• Comparing lsns ↔ nsenter / unshare / ip-netns peer tip pages under one binder.
• Testing JSON output only when the syllabus authorizes that drill on lab resources.

Scope we will not cover

• No crack/pirate/keygen via lsns.
• No intentional unauthorized namespace enumeration against foreign hosts.
• No secret-theft or process/credential harvesting via namespace dumps on hosts you do not own.
• No cookbooks that weaken namespace isolation or plant escape paths without authorization.

Beginner path (authorized only)

1. Obtain one syllabus-approved disposable lab host with util-linux lsns available.
2. Prefer a throwaway lab container/VM before any deep walk.
3. With authorization, run lsns and (optionally) lsns -t net; quote non-secret NS type/NPROCS/NSFS labels as Evidence.
4. Optional: peer tip pages above when the syllabus asks.
5. Stop at literacy — no attack or unauthorized escape cookbooks.

Practical notes for authorized labs

• lsns lists namespaces visible to the caller — keep Evidence labels distinct from nsenter-tips enter drills.
• Pair with ip-netns-tips when the syllabus zooms on named network namespaces.
• Namespace dumps may embed process context — never paste secrets into notes or git.
• Prefer documenting NS type and NSFS labels the syllabus authorized without dumping full privileged inspect JSON.
• Never commit lsns dumps with secrets to git — even for labs.

FAQ-aligned refusals (quick)

• Foreign-host namespace dumps → refuse.
• Unauthorized namespace-escape / isolation-weaken cookbooks → refuse.
• Attack/credential-theft framing → refuse.

For legal, authorized and educational use only.

FAQ

Sources