Groups > linux.debian.bugs.dist > #1029364

Bug#898446: Please reconsider enabling the user namespaces by default

From	Simon McVittie <smcv@debian.org>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#898446: Please reconsider enabling the user namespaces by default
Date	2020-10-20 18:30 +0200
Message-ID	<B22Gl-2Ox-3@gated-at.bofh.it> (permalink)
References	(3 earlier) <zVKOl-6Jw-1@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> <zW2id-S5-3@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> <zW2id-S5-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

On Thu, 16 Apr 2020 at 03:09:25 +0100, Ben Hutchings wrote:
> I don't think we should keep patching in
> kernel.unprivileged_userns_clone forever, so the documented way to
> disable user namespaces should be setting user.max_user_namespaces to
> 0.  But then there's no good way to have a drop-in file that changes
> back to the upstream default, because that's dependent on system memory
> size.
> 
> So I think we should do something like this:
> 
> * Document user.max_user_namespaces in procps's shipped
>   /etc/sysctl.conf
> * Set kernel.unprivileged_userns_clone to 1 by default, and deprecate
>   it (log a warning if it's changed)
> * Document the change in bullseye release notes

Is this something you intend to do before bullseye, or is it now going
to be after bullseye?

If this is intended to happen before bullseye, I'd like enough time
before the freeze to put an as-graceful-as-possible transition in place
in the bubblewrap package.

(I'm not sure what form that transition should take - suggestions welcome!
Ideally I'd like bubblewrap to be setuid root if and only if we are still
using a kernel where it needs to be.)

    smcv

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#898446: Please reconsider enabling the user namespaces by default Simon McVittie <smcv@debian.org> - 2020-10-20 18:30 +0200
  Bug#898446: Please reconsider enabling the user namespaces by default Salvatore Bonaccorso <carnil@debian.org> - 2020-10-22 23:00 +0200
    Bug#898446: Please reconsider enabling the user namespaces by default Moritz Muehlenhoff <jmm@inutil.org> - 2020-10-22 23:10 +0200
    Bug#898446: Please reconsider enabling the user namespaces by default Bastian Blank <waldi@debian.org> - 2020-10-23 09:00 +0200
  Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2020-10-24 03:30 +0200

csiph-web