Date: Thu, 11 May 2023 17:20:20 +0200 From: Florian Weimer <fweimer@...hat.com> To: Tobias Heider <tobias.heider@...onical.com> Cc: oss-security@...ts.openwall.com, Turritopsis Dohrnii Teo En Ming <tdtemccnp@...il.com>, ceo@...-en-ming-corp.com, Piotr Krysiuk <piotras@...il.com> Subject: Re: New Linux kernel NetFilter flaw gives attackers root privileges * Tobias Heider: > Another thing worth mentioning is that the apparmor team has done some very > interesting work on providing finer control over unprivileged user namespaces > on a per application basis: > https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction > > This would allow having opt-in unprivileged userns support only for > confined and explicitly permitted applications and could hopefully > drastically reduce the impact of similar bugs in the future. Doesn't unprivileged chroot need user namespace support? So a side effect of disabling it might be to force applications to switch to userspace emulation of pathname lookup. That doesn't seem like a good tradeoff? Thanks, Florian
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.