Re: [GIT PULL] LSM patches for v6.1

[Vegard Nossum]

On 10/4/22 22:55, Linus Torvalds wrote:
> And I think you are in denial about how many problems the
> user-namespace stuff has caused.
>
> Distros are literally turning it off entirely because the whole "let
> users create their own namespace" has *NOT* been a great success.

[...]

> I'm not saying that an LSM is the only place to do it, but I don't
> think there have been any better suggestions either.

I had posted a patch here for restricting module loading requests from
user namespaces as a way to reduce attack surface:

v2: 
https://lore.kernel.org/all/20220815082753.6088-1-vegard.nossum@xxxxxxxxxx/

v1: 
https://lore.kernel.org/all/20220809185229.28417-1-vegard.nossum@xxxxxxxxxx/

I'll respond to Serge's comment on the v2 thread.


Vegard