Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Fri, 3 Feb 2017 08:13:33 -0800
From: Jessica Frazelle <>
Subject: Container Hardening


I made this one page site[1] to detail trying to harden namespaces in
the kernel. The other primitives containers use are included as well,
but if we are honest we all know namespaces need the most help.

Solar mentioned just using this mailing list for this initiative as
well. That's great with me because I would love all your feedback and

I think the first focus should be on preventing priviledge escalations
in user namespaces. This has the largest attack surface. The
fundamental problem seems to be that not many people have inspected
user namespaces and the various interactions with other parts of the
kernel. I will be trying to do this and would love any help from
anyone interested. We could split up the various systems and do some
research to find out just how far this rabbit hole goes.

In the past, one of the ways to fix vulnerabilities with user
namespaces was to disallow the interaction, for instance CLONE_FS.

I'm sure we can't have that as a solution for everything, but I'm
hoping by working together we can come up with a well-informed



Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.