Bug#898446: Please reconsider enabling the user namespaces by default

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#898446: Please reconsider enabling the user namespaces by default
Date	2018-05-14 04:50 +0200
Message-ID	<vPbIJ-2CZ-3@gated-at.bofh.it> (permalink)
References	(1 earlier) <vOMhj-47G-3@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> <vP38t-5JQ-13@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> <vP38t-5JQ-13@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Control: tag -1 - moreinfo

On Sun, 2018-05-13 at 19:19 +0200, Frederik Himpe wrote:
> On Sun, 13 May 2018 00:33:02 +0100 Ben Hutchings <ben@decadent.org.uk>
> wrote:
> > Control: tag -1 moreinfo
> > 
> > On Fri, 2018-05-11 at 20:44 +0200, Laurent Bigonville wrote:
> > > Source: linux
> > > Version: 4.16.5-1
> > > Severity: normal
> > > 
> > > Hi,
> > > 
> > > Firefox (and probably other applications) are using user namespaces these
> > > days to enhance the security.
> > 
> > Can you provide some information about this?
> 
> There is some info here:
> https://www.morbo.org/2018/05/linux-sandboxing-improvements-in_10.html

Quoting from there:

> This [..] complements the existing sandbox: in addition to blocking
> specific system calls like `open` and `connect`, we can prevent
> filesystem/network access no matter how it is requested. This is part
> of our defense in depth: if a clever attacker manages to bypass one
> layer of protection, that still won't be enough to compromise the
> system.

So it seems that for Firefox user namespaces are nice to have, but not
critical for the sandbox.

Ben.

-- 
Ben Hutchings
For every action, there is an equal and opposite criticism. - Harrison

Thread

Bug#898446: Please reconsider enabling the user namespaces by default Laurent Bigonville <bigon@debian.org> - 2018-05-11 20:50 +0200
  Processed: Re: Bug#898446: Please reconsider enabling the user  namespaces by default "Debian Bug Tracking System" <owner@bugs.debian.org> - 2018-05-13 01:40 +0200
  Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2018-05-13 01:40 +0200
    Bug#898446: Please reconsider enabling the user namespaces by default Frederik Himpe <frederik@frehi.be> - 2018-05-13 19:40 +0200
      Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2018-05-14 04:50 +0200
    Bug#898446: Please reconsider enabling the user namespaces by default Moritz Mühlenhoff <jmm@inutil.org> - 2018-05-13 23:10 +0200
      Bug#898446: Please reconsider enabling the user namespaces by default Simon McVittie <smcv@debian.org> - 2020-03-30 12:10 +0200
        Bug#898446: Please reconsider enabling the user namespaces by default Moritz Mühlenhoff <jmm@inutil.org> - 2020-03-30 14:30 +0200
        Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2020-04-15 04:00 +0200
          Bug#898446: Please reconsider enabling the user namespaces by default Simon McVittie <smcv@debian.org> - 2020-04-15 09:40 +0200
            Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2020-04-16 04:20 +0200
              Bug#898446: Please reconsider enabling the user namespaces by default Simon McVittie <smcv@debian.org> - 2020-10-20 18:30 +0200
                Bug#898446: Please reconsider enabling the user namespaces by default Salvatore Bonaccorso <carnil@debian.org> - 2020-10-22 23:00 +0200
                Bug#898446: Please reconsider enabling the user namespaces by default Moritz Muehlenhoff <jmm@inutil.org> - 2020-10-22 23:10 +0200
                Bug#898446: Please reconsider enabling the user namespaces by default Bastian Blank <waldi@debian.org> - 2020-10-23 09:00 +0200
                Bug#898446: Please reconsider enabling the user namespaces by default Antoine Beaupré <anarcat@debian.org> - 2020-11-17 17:30 +0100
                Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2020-11-17 19:00 +0100
                Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2020-12-13 17:40 +0100
                Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2020-10-24 03:30 +0200
    Bug#898446: Please reconsider enabling the user namespaces by default Laurent Bigonville <bigon@debian.org> - 2018-05-14 07:30 +0200
  Processed: Re: Bug#898446: Please reconsider enabling the user  namespaces by default "Debian Bug Tracking System" <owner@bugs.debian.org> - 2018-05-14 04:50 +0200
  Bug#898446: (no subject) Nikolas Nyby <nikolas@gnu.org> - 2019-03-06 15:50 +0100
  Bug#898446: Please reconsider enabling the user namespaces by default Jordan Glover <Golden_Miller83@protonmail.ch> - 2020-10-23 17:30 +0200
  Bug#898446: marked as done (Please reconsider enabling the user  namespaces by default) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-12-17 13:10 +0100

csiph-web