Re: [GIT PULL] LSM patches for v6.1
From: Vegard Nossum
Date: Thu Oct 06 2022 - 04:29:54 EST
On 10/4/22 22:55, Linus Torvalds wrote:
And I think you are in denial about how many problems the
user-namespace stuff has caused.
Distros are literally turning it off entirely because the whole "let
users create their own namespace" has *NOT* been a great success.
I'm not saying that an LSM is the only place to do it, but I don't
think there have been any better suggestions either.
I had posted a patch here for restricting module loading requests from
user namespaces as a way to reduce attack surface:
I'll respond to Serge's comment on the v2 thread.