Security Implications for User namespaces

[HulaHoopWhonix]

User namespaces are described as a particularly risky kernel feature that has allowed privilege escalation in the past. I think its useful to keep around but its probably best avoided in supported profiles.

subgraph/oz#11

[netblue30]

User namespace is more like a baseball bat. Imperfect, with its own problems, but works very well in some cases.

Firejail has support to disable various sandboxing features the user might find undesirable. You can do it at compile time (./configure --help) or at run time (man firejail-config). You can disable user namespaces, chroot, and a number of other features. So far I've heard complains about user namespace and networking.

[curiosity-seeker]

FWIW, user namespaces are not supported by Arch Linux, either, because of security considerations.

[HulaHoopWhonix]

Ah OK. You're aware of this topic: and discussed implications: #9 (comment)

I'll search harder next time :)