2018-07-20 15:37 GMT+02:00 Eric W. Biederman <ebiederm@xxxxxxxxxxxx>: > Kees Cook <keescook@xxxxxxxxxxxx> writes: > >>> +CONFIG_USER_NS=n >>> +~~~~~~~~~~~~~~~~ >>> + >>> +**Negative side effects level:** Medium >> >> Unfortunately I think this is High or Extreme. USER_NS gets a lot of use. >> >>> +**- Protection type:** Attack surface reduction >>> + >>> +This allows containers to use user namespaces to provide different >>> +user info for different servers. >>> +User namespaces have been abused in the past for privilege >>> +escalation. > > This is not a particularly good description. You are right, I've been a bit shallow... Thank you for pointing it out. I didn't mean to say that user namespaces are bad for security in general. I'll make this less ambiguous in the next revision. > User namespaces do indeed increase the attack surface of programs that > don't use them. > > User namespaces when used to build ``unprivileged containers'' remove or > at least drastically reduce the need to run as root when setting up > containers. Which is attack surface reduction. > > User namespaces make available tools that are commonly used to build > sandboxes. Chrome for example uses users namespaces if they are > available as part of setting up it's sandbox. > > User namespaces are not limited to containers. > > The bugs in the attack surface that user namespaces expose that have > been used for privilege escalation have to the best of my knowledge > closed. So while there is some danger in the increased attack surface > we are looking at implementation defects rather than design defects. > > Eric -- To unsubscribe from this list: send the line "unsubscribe linux-doc" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
