Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 22 Jan 2016 14:39:03 -0800
From: Kees Cook <>
To: Andrew Morton <>
Cc: Kees Cook <>,
	Al Viro <>,
	Richard Weinberger <>,
	"Eric W. Biederman" <>,
	Andy Lutomirski <>,
	Robert Święcki <>,
	Dmitry Vyukov <>,
	David Howells <>,
	Miklos Szeredi <>,
	Kostya Serebryany <>,
	Alexander Potapenko <>,
	Eric Dumazet <>,
	Sasha Levin <>,,,
Subject: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled 

There continues to be unexpected side-effects and security exposures
via CLONE_NEWUSER. For many end-users running distro kernels with
CONFIG_USER_NS enabled, there is no way to disable this feature when
desired. As such, this creates a sysctl to restrict CLONE_NEWUSER so
admins not running containers or Chrome can avoid the risks of this


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.