Re: [GIT PULL] LSM patches for v6.1

From: Vegard Nossum
Date: Thu Oct 06 2022 - 04:29:54 EST

On 10/4/22 22:55, Linus Torvalds wrote:
And I think you are in denial about how many problems the
user-namespace stuff has caused.

Distros are literally turning it off entirely because the whole "let
users create their own namespace" has *NOT* been a great success.


I'm not saying that an LSM is the only place to do it, but I don't
think there have been any better suggestions either.

I had posted a patch here for restricting module loading requests from
user namespaces as a way to reduce attack surface:



I'll respond to Serge's comment on the v2 thread.