Re: [kernel-hardening] Re: [PATCH 0/2] sysctl: allow CLONE_NEWUSER to be disabled

From: Austin S. Hemmelgarn
Date: Thu Jan 28 2016 - 07:55:33 EST

On 2016-01-28 03:56, Serge E. Hallyn wrote:
On Mon, Jan 25, 2016 at 10:57:32PM -0600, Eric W. Biederman wrote:
What sounds like a generally useful feature that would cover your use
case and many others is a per user limit on the number of user
namespaces users may create.

Ok, I'm sorry, but after thinking about this quite awhile, I think this
is a bad idea. If I'm allowed to create exactly one, then (a) I won't
be able to run two instances of chrome (does chrome use one userns per
tab or per application?), yet (b) i can easily just not use chrome and
use my allocation to run a vulnerability.
Ignore regular users WRT the ability to limit to one or two namespace instances, the advantage of being able to limit to one or two user namespaces for a given user is that it prevents daemons that use it for sand-boxing from being exploited to create more. If we go with Eric's suggestion, there is absolutely no reason on a regular desktop system that the users used for a graphical login would have to be limited.

IMO, having a (hopefully temporary, so cleanly separated out) sysctl,
which perhaps goes so far as to kill all non-init user namespaces when
set to -1, makes the most sense. I still think the harm due to having
userspace not being able to rely on user namespaces will, long term, be
worse than the security implications of having user namespaces always
enabled.
Userspace can't rely on them as it is right now. The default kernel config has them disabled, and a number of distros are refusing to ship kernels with them enabled at least in the short term, wheras a number are only shipping kernels with them enabled (I'd be willing to bet that part of what prompted this originally was Chrome). Just by virtue of this, you can't rely on them being there and need to gracefully handle the situation if they aren't. Adding a sysctl allowing them to be disabled completely on a kernel that has support built in would not make them all that much more unreliable than they already are.