Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 4 Feb 2022 10:45:15 +0100
From: Christian Brauner <>
To: "Anton V. Boyarshinov" <>
	Christoph Hellwig <>,
	Linus Torvalds <>
Subject: Re: [PATCH] Add ability to disallow idmapped mounts

On Fri, Feb 04, 2022 at 09:53:38AM +0300, Anton V. Boyarshinov wrote:
> Idmapped mounts may have security implications [1] and have
> no knobs to be disallowed at runtime or compile time.
> This patch adds a sysctl and a config option to set its default value.
> [1]
> Based on work from Alexey Gladkov <>.
> Signed-off-by: Anton V. Boyarshinov <>
> ---

Thank your for the general idea, Anton.

If you want to turn off idmapped mounts you can already do so today via:
echo 0 > /proc/sys/user/max_user_namespaces

Aside from that, idmapped mounts can only be created by fully privileged
users on the host for a selected number of filesystems. They can neither
be created as an unprivileged user nor can they be created inside user

I appreciate the worry. Any new feature may have security implications
and bugs. In addition, we did address these allegations multiple times
already (see [1], [2], [3], [4], [5]).

As the author/maintainer of this feature,
Nacked-by: Christian Brauner <>


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.