Linux 3.8 introduced unprivileged user namespaces [pdf]

Re:Linux 3.8 introduced unprivileged user namespaces [pdf] by geofft on Wednesday December 18, 2019 @11:03AM (#21826188)

The given title (currently "Linux 4.6 introduced unpriviledged user namespaces") isn't accurate - unprivileged user namespaces have been around since this commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/lin...

This is included in kernel 3.8 released in 2013, and the linked PDF says that's when CLONE_NEWUSER itself was released - i.e., ever since user namespaces have existed, they've been allowed to unprivileged users.

Some downstream distributors, including Debian, started carrying a patch that added a restriction back in via the kernel.unprivileged_userns_clone sysctl. This is because allowing unprivileged user namespaces exposes a lot of attack surface to users. There's nothing fundamentally unsafe about it, but there are many kernel components for which bugs are only exploitable by unprivileged users if the feature is on. See https://lwn.net/Articles/673597/ for more discussion. (I thought a version of that patch eventually got accepted upstream, but I can't find it.)

The only reference to kernel 4.6 in the document is CLONE_NEWCGROUP, which is entirely unrelated to unprivileged user namespaces.

[ Parent | on HN ]

Re:Linux 3.8 introduced unprivileged user namespaces [pdf] by black_puppydog on Wednesday December 18, 2019 @01:01PM (#21827453)

I've been bitten by this one over and over again in the last months. It's really unfortunate, and I see both sides' arguments here, but the effect is that on debian machines, running electron apps has become (even more of) a hassle, because chromium's sandboxing mechanism relies on these user namespaces.

https://github.com/electron/electron/issues/17972

[ Parent | on HN ]

Re:Linux 3.8 introduced unprivileged user namespaces [pdf] by dang on Wednesday December 18, 2019 @03:34PM (#21829131)

Ok, we've subtracted the pair (1, -0.2) from Linux in the title above.

Edit: corrected from 0.8

Edit edit: corrected from (1, 0.2)

[ Parent | on HN ]

Re:Linux 3.8 introduced unprivileged user namespaces [pdf] by toraobo on Wednesday December 18, 2019 @04:09PM (#21829493)

Linux versions are not decimal, you subtracted 1.-2

[ Parent | on HN ]

Re:Linux 3.8 introduced unprivileged user namespaces [pdf] by dang on Wednesday December 18, 2019 @05:29PM (#21830152)

Oh dear. Fixed. Thanks!

[ Parent | on HN ]

Re:Linux 3.8 introduced unprivileged user namespaces [pdf] by naniwaduni on Wednesday December 18, 2019 @06:21PM (#21830523)

Subtracting (1, 0.2) would've left 3.4!

[ Parent | on HN ]

Re:Linux 3.8 introduced unprivileged user namespaces [pdf] by dang on Thursday December 19, 2019 @02:23AM (#21832734)

I need to stop doing this so hastily. Argh!

[ Parent | on HN ]

Re:Linux 3.8 introduced unprivileged user namespaces [pdf] by majke on Wednesday December 18, 2019 @11:15AM (#21826330)

You are totally right, as confirmed by Mr Kerrisk here: https://twitter.com/mkerrisk/status/1207018543193063424

[ Parent | on HN ]