I'm working on isolating namespaces using clone() in a Linux environment and I have a question regarding CIFS mounts.

If I use clone() to isolate the network namespace (and potentially other namespaces) for a process, would it be possible to perform a CIFS mount from that process with user permissions only (without root access)?

Specifically:

Can CIFS mounts be performed in a namespace-isolated environment without root privileges?

If it’s not possible to mount CIFS with user permissions, does the process need root access within the isolated namespace to successfully perform the mount?

Any insights or experiences regarding namespace isolation and mounting filesystems like CIFS without root would be greatly appreciated!

Thanks in advance!

I tried using unshare with newns or newuser to isolate the namespace and perform the mount, but I encountered the error: 'mount: Operation not permitted'.

i tried this code

#define _GNU_SOURCE
#include <stdio.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sched.h>
#include <errno.h>

void write_to_file(const char *path, const char *format, ...) {
    FILE *fp = fopen(path, "w");
    if (!fp) {
        perror("fopen");
        exit(EXIT_FAILURE);
    }

    va_list args;
    va_start(args, format);
    if (vfprintf(fp, format, args) < 0) {
        perror("vfprintf");
        exit(EXIT_FAILURE);
    }
    fclose(fp);
    va_end(args);
}

int create_directory_if_needed(const char *path) {
    if (mkdir(path, 0777) == -1 && errno != EEXIST) {
        perror("mkdir");
        return -1;
    }
    return 0;
}

static int setup_mount_environment() {
    const char *mount_point = "/tmp/test/smb_share";
    const char *smb_share = "//192.168.1.1/shared_folder";

    if (create_directory_if_needed(mount_point)) {
        return -1;
    }
    printf("[*] do mount!\n");
    if (mount(smb_share, mount_point, "cifs", 0,
            "username=guest,password=,uid=0,gid=0,vers=3.0") == -1) {
        int saved_errno = errno;  
        printf("[DEBUG] Mount failed: %s\n", strerror(saved_errno));  
        system("dmesg | tail -n 10");  
        return -1;
    }

    return 0;
}

int main() {
    printf("[*] Unsharing namespaces...\n");
    
    if (unshare(CLONE_NEWUSER | CLONE_NEWNS) == -1) {
        perror("unshare failed");
        return EXIT_FAILURE;
    }

    printf("[*] Setting UID/GID mappings...\n");
    write_to_file("/proc/self/uid_map", "0 %d 1", getuid());
    write_to_file("/proc/self/setgroups", "deny");
    write_to_file("/proc/self/gid_map", "0 %d 1", getgid());

    printf("[*] Attempting SMB mount...\n");
    if (setup_mount_environment() == -1) {
        return EXIT_FAILURE;
    }

    printf("[*] SMB mount success!\n");
    return EXIT_SUCCESS;
}