[PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled

From: Kees Cook
Date: Fri Jan 22 2016 - 17:39:39 EST

There continues to be unexpected side-effects and security exposures
via CLONE_NEWUSER. For many end-users running distro kernels with
CONFIG_USER_NS enabled, there is no way to disable this feature when
desired. As such, this creates a sysctl to restrict CLONE_NEWUSER so
admins not running containers or Chrome can avoid the risks of this