Date: Sat, 04 Feb 2017 08:21:07 +1300 From: ebiederm@...ssion.com (Eric W. Biederman) To: Jessica Frazelle <me@...sfraz.com> Cc: Thomas Garnier <thgarnie@...gle.com>, Kernel Hardening <kernel-hardening@...ts.openwall.com> Subject: Re: Container Hardening Jessica Frazelle <me@...sfraz.com> writes: > Yeah I can definitely come up with a list. The interesting thing is > some vulnerabilities don't even need for the process to be _in_ a user > namespace, just that CONFIG_USERNS=y. So as far as I currently know, a > lot has to do with hitting these obscure-ish code paths. But will work > on a list :) I believe you are a little misinformed about the current situation, but one thing I can agree with is more people and more eyeballs on the code can not hurt. My best estimate of where things are at is at this point most of the design issues have been fixed, and that user namespaces and namespaces in general are about as buggy as the rest of the kernel. As any process can create a user namespace a system does not have to be using user namespaces to be vulnerable to their issues. At the same time there are a set of sysctls under /proc/sys/user/ that can be used to reduce the attack surface if you are not using the features. I will be happy to help resolve and merge any bugs you happen to find. Although if they are ordinary kernel bugs in the network stack it is probably easiest just to go through David Miller, and the netdev mailing list. I won't mind being Cc'd in that case. Eric
Powered by blists - more mailing lists
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.