On 13/08/14 01:21 PM, Mihamina Rakotomandimby wrote: > On 08/13/2014 08:09 PM, Leonid Isaev wrote: >> As you know, user_ns is a necesary prerequisite for unpriviileged >> containers: >> https://www.stgraber.org/2014/01/17/lxc-1-0-unprivileged-containers/ >> . AFAIU, >> currently only Ubuntu 14.04 supports those. >> >> However, I agree with you that CONFIG_USER_NS is better left disabled >> in -ARCH >> kernels. After all, people using containers should be able to compile >> a custom >> kernel... > > Hi all, > > One use case of using LXC might be to want to quicky have a virtual > environment running. > > Easing the work by defaulting to a ready-to-work kernel would be nice. > > Regards. Containers work fine without CONFIG_USER_NS. You just can't spawn them without being a privileged user. There's a good reason for that, as shown by the endless stream of local root exploits via user namespaces. Having uid 0 or root equivalent capabilities in a container with or without user namespaces is equivalent to root access on the host due to flaws in the implementation. By removing the check for a privileged user, upstream just guaranteed that sane distributions are not going to enable the feature (at least without patching it, which isn't Arch's style).
Attachment:
signature.asc
Description: OpenPGP digital signature
