Can you create per user network interfaces in Linux?

Question

So Linux does an excellent job in managing rights per user. You all know the file and process management.

But is it also possible to create a virtual private network interface?

Say Linux user John Doe (jdoe) wants to test network software without being root and disturbing the real netif. Can you create an interface that belongs to jdoe only? Like eth0, eth1 and ethJdoe, making ethJdoe belonging to jdoe.

Answer 1

create a command that let jdoe run 'ifconfig eth0 [whatever]' (e.g. a shell script) let him use sudo to run the command. if you worry about him doing anything too wrong, add code to prevent pipe, etc. being passed onto the command.

this would be easier than hacking the network stack.

Answer 2

In linux (most recent editions) you can define a network namespace that is isolated from the network facilities of the host pc. You need then to connect the namespace to the main network of the host, wich is a little bit complicated, but you dont have to let the user do it, the admistrator of the system can do it. So yes, it is possible to do it. For more information you can start by checking namespaces and the unshare command. For practical reasons, it makes more sense to use some kind of Isolation/Virtualization scheme to do this. Some of these systems build upon the user namespace paradigm

Answer 3

Not that I know of in Linux. What network software depends on him doing ifup and ifdown? I know I barely know your problem, but this sounds like a job for a Virtual Machine image.

The design of some microkernels allows 'drivers' in user level which can do things like this, but there's not a true microkernel out there that can do this and will actually run useful software. The Hurd always had things like this as an example of why the design was cool, but the Hurd is still not useful for anything but research purposes.