[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 23 Jan 2016 00:44:01 +0000
From: Serge Hallyn <serge.hallyn@...ntu.com>
To: Kees Cook <keescook@...omium.org>
Cc: Robert Święcki <robert@...ecki.net>,
Ben Hutchings <ben@...adent.org.uk>,
Andrew Morton <akpm@...ux-foundation.org>,
Al Viro <viro@...iv.linux.org.uk>,
Richard Weinberger <richard@....at>,
"Eric W. Biederman" <ebiederm@...ssion.com>,
Andy Lutomirski <luto@...capital.net>,
Dmitry Vyukov <dvyukov@...gle.com>,
David Howells <dhowells@...hat.com>,
Kostya Serebryany <kcc@...gle.com>,
Alexander Potapenko <glider@...gle.com>,
Eric Dumazet <edumazet@...gle.com>,
Sasha Levin <sasha.levin@...cle.com>,
"linux-doc@...r.kernel.org" <linux-doc@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
"kernel-hardening@...ts.openwall.com" <kernel-hardening@...ts.openwall.com>
Subject: Re: [PATCH 2/2] sysctl: allow CLONE_NEWUSER to be disabled
Quoting Kees Cook (keescook@...omium.org):
> On Fri, Jan 22, 2016 at 2:55 PM, Robert Święcki <robert@...ecki.net> wrote:
> > 2016-01-22 23:50 GMT+01:00 Kees Cook <keescook@...omium.org>:
> >
> >>> Seems that Debian and some older Ubuntu versions are already using
> >>>
> >>> $ sysctl -a | grep usern
> >>> kernel.unprivileged_userns_clone = 0
> >>>
> >>> Shall we be consistent wit it?
> >>
> >> Oh! I didn't see that on systems I checked. On which version did you find that?
> >
> > $ uname -a
> > Linux bc1 4.3.0-0.bpo.1-amd64 #1 SMP Debian 4.3.3-5~bpo8+1
> > (2016-01-07) x86_64 GNU/Linux
> > $ cat /etc/debian_version
> > 8.2
>
> Ah-ha, Debian only, though it looks like this was just committed to
> the Ubuntu kernel tree too:
>
>
> > IIRC some older kernels delivered with Ubuntu Precise were also using
> > it (but maybe I'm mistaken)
>
> I don't see it there.
>
> I think my patch is more complete, but I'm happy to change the name if
> this sysctl has already started to enter the global consciousness. ;)
>
> Serge, Ben, what do you think?
>
> -Kees
Hey,
I had originally written this for Ubuntu when userns was still new
and not upstream. Then we dropped it when it got upstream.
The reason we are re-adding it is because we're going to be pushing the
envelop again wrt unprivileged userns usage. Seth has been working on
supporting mounts of fuse, for instance. When everything is upstream,
(or we drop it :) we'll drop the patch again.
-serge
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
