[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 22 Jan 2016 14:39:03 -0800
From: Kees Cook <keescook@...omium.org>
To: Andrew Morton <akpm@...ux-foundation.org>
Cc: Kees Cook <keescook@...omium.org>,
Al Viro <viro@...iv.linux.org.uk>,
Richard Weinberger <richard@....at>,
"Eric W. Biederman" <ebiederm@...ssion.com>,
Andy Lutomirski <luto@...capital.net>,
Robert Święcki <robert@...ecki.net>,
Dmitry Vyukov <dvyukov@...gle.com>,
David Howells <dhowells@...hat.com>,
Miklos Szeredi <mszeredi@...e.cz>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Eric Dumazet <edumazet@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>,
linux-doc@...r.kernel.org,
linux-kernel@...r.kernel.org,
kernel-hardening@...ts.openwall.com
Subject: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled
There continues to be unexpected side-effects and security exposures
via CLONE_NEWUSER. For many end-users running distro kernels with
CONFIG_USER_NS enabled, there is no way to disable this feature when
desired. As such, this creates a sysctl to restrict CLONE_NEWUSER so
admins not running containers or Chrome can avoid the risks of this
feature.
-Kees
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
