Groups > linux.debian.bugs.dist > #1037381

Bug#898446: Please reconsider enabling the user namespaces by default

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#898446: Please reconsider enabling the user namespaces by default
Date	2020-12-13 17:40 +0100
Message-ID	<BlCzE-WN-9@gated-at.bofh.it> (permalink)
References	(10 earlier) <Bcc1I-2gs-7@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> <BcdqN-2Yn-5@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> <BcdqN-2Yn-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Tue, 2020-11-17 at 17:19 +0000, Ben Hutchings wrote:
> On Tue, 2020-11-17 at 11:18 -0500, Antoine Beaupré wrote:
> [...]
> > Could we get a little more hard data about the attack vectors here? I
> > totally trust the security team's "gut feeling" on this, but it would be
> > great to be able to evaluate more concretely what we're talking about
> > here.
> > 
> > Local root privilege escalation, basically? Can we get a sense of what
> > those vulerabilities are, say with some example CVEs?
> 
> Yes, local privilege escalation.
> 
> From the advisories I've prepared, I think these are all LPEs that were
> mitigated by our current patch:
[...]
> They seem to have slowed to a trickle at this point.  And there are
> sadly lots of other LPE bugs that it has no effect on.
> 
> > I'm asking because my main concern with security these days is with the
> > web browser. It's this huge gaping hole: every measure we can take to
> > sandbox that thing is become more and more critical, so I wonder if the
> > our tradeoff's evaluation is well adjusted here, especially considering
> > a lot of user_ns consumers are bypassing those restrictions by running
> > as root anyways...
> 
> I tend to agree with this.
[...]

Since no-one contradicted this, I've gone ahead and changed the default
on the master branch.  I added a NEWS entry for linux-image meta-
packages to let people know how to change it back if they want.

Ben.

-- 
Ben Hutchings
The two most common things in the universe are hydrogen and stupidity.

Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

Bug#898446: Please reconsider enabling the user namespaces by default Antoine Beaupré <anarcat@debian.org> - 2020-11-17 17:30 +0100
  Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2020-11-17 19:00 +0100
    Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2020-12-13 17:40 +0100

csiph-web