Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.bugs.dist > #897618
| From | Ben Hutchings <ben@decadent.org.uk> |
|---|---|
| Newsgroups | linux.debian.bugs.dist, linux.debian.kernel |
| Subject | Bug#898446: Please reconsider enabling the user namespaces by default |
| Date | 2018-05-14 04:50 +0200 |
| Message-ID | <vPbIJ-2CZ-3@gated-at.bofh.it> (permalink) |
| References | (1 earlier) <vOMhj-47G-3@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> <vP38t-5JQ-13@gated-at.bofh.it> <vOlh7-2Ek-5@gated-at.bofh.it> <vP38t-5JQ-13@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
Cross-posted to 2 groups.
[Multipart message — attachments visible in raw view] - view raw
Control: tag -1 - moreinfo On Sun, 2018-05-13 at 19:19 +0200, Frederik Himpe wrote: > On Sun, 13 May 2018 00:33:02 +0100 Ben Hutchings <ben@decadent.org.uk> > wrote: > > Control: tag -1 moreinfo > > > > On Fri, 2018-05-11 at 20:44 +0200, Laurent Bigonville wrote: > > > Source: linux > > > Version: 4.16.5-1 > > > Severity: normal > > > > > > Hi, > > > > > > Firefox (and probably other applications) are using user namespaces these > > > days to enhance the security. > > > > Can you provide some information about this? > > There is some info here: > https://www.morbo.org/2018/05/linux-sandboxing-improvements-in_10.html Quoting from there: > This [..] complements the existing sandbox: in addition to blocking > specific system calls like `open` and `connect`, we can prevent > filesystem/network access no matter how it is requested. This is part > of our defense in depth: if a clever attacker manages to bypass one > layer of protection, that still won't be enough to compromise the > system. So it seems that for Firefox user namespaces are nice to have, but not critical for the sandbox. Ben. -- Ben Hutchings For every action, there is an equal and opposite criticism. - Harrison
Back to linux.debian.bugs.dist | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Bug#898446: Please reconsider enabling the user namespaces by default Laurent Bigonville <bigon@debian.org> - 2018-05-11 20:50 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2018-05-13 01:40 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Frederik Himpe <frederik@frehi.be> - 2018-05-13 19:40 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Ben Hutchings <ben@decadent.org.uk> - 2018-05-14 04:50 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Moritz Mühlenhoff <jmm@inutil.org> - 2018-05-13 23:10 +0200
Bug#898446: Please reconsider enabling the user namespaces by default Laurent Bigonville <bigon@debian.org> - 2018-05-14 07:30 +0200
csiph-web