Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #897418
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Newsgroups | linux.debian.bugs.dist, linux.debian.kernel |
| Subject | Bug#898446: Please reconsider enabling the user namespaces by default |
| Date | 2018-05-13 01:40 +0200 |
| Message-ID | <vOMhj-47G-3@gated-at.bofh.it> (permalink) |
| References | <vOlh7-2Ek-5@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Cross-posted to 2 groups.
[Multipart message — attachments visible in raw view] - view raw
Control: tag -1 moreinfo
On Fri, 2018-05-11 at 20:44 +0200, Laurent Bigonville wrote:
> Source: linux
> Version: 4.16.5-1
> Severity: normal
>
> Hi,
>
> Firefox (and probably other applications) are using user namespaces these
> days to enhance the security.
Can you provide some information about this?
> Debian is disabling these since 2013, the original patch states it's a
> short term solution, but we are here 5 years later and they are still
> disabled.
And this still mitigates a significant fraction of the security issues
found in the kernel.
> Apparently debian (and ubuntu) and arch are the only distributions
> disabling the user namespaces.
>
> Is there a list of remaining issues with the user namespaces? IIRC the
> only discussion I've seen were about adding upstream the option to
> disable them at runtime, nothing else.
>
> Is it a possibility to reenable these for buster?
User namespaces *are* enabled - but by default, they can only be
created by root. It is still possible to change that with a sysctl.
Ben.
--
Ben Hutchings
The most exhausting thing in life is being insincere.
- Anne Morrow Lindberg
Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Bug#898446: Please reconsider enabling the user namespaces by default Laurent Bigonville <bigon@debian.org> - 2018-05-11 20:50 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2018-05-13 01:40 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Frederik Himpe <frederik@frehi.be> - 2018-05-13 19:40 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2018-05-14 04:50 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Moritz Mühlenhoff <jmm@inutil.org> - 2018-05-13 23:10 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Laurent Bigonville <bigon@debian.org> - 2018-05-14 07:30 +0200
csiph-web