Am 18.10.2015 um 23:49 schrieb Tobias Markus: > But before we continue arguing endlessly, I just got an idea: What about > adding a sysctl to enable/disable enforcement of the hypothetical > CAP_SYS_USER_NS, just like with /proc/sys/kernel/kptr_restrict and > CAP_SYSLOG? Would also prevent any potential userspace breakage.
My argument stands, hiding user namespaces behind whatever switch and rendering it into a second class citizen does not improve its security. Especially ad-hoc solutions are not expedient. Reducing the attack surface must not lead to gazillions of new capabilities, sysctl switches, etc... user namespaces are neither the first nor the last "critical" kernel feature. I'm sure RHEL will ship a SELinux boolean to disable user namespaces as they do for many other OS features. This is fine and exactly why we have LSM. Thanks, //richard -- To unsubscribe from this list: send the line "unsubscribe linux-api" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
