Re: [GIT PULL] LSM patches for v6.1

From: Theodore Ts'o
Date: Thu Oct 06 2022 - 10:42:19 EST

Eric, there's one thing I don't get about why you hate LSM's having
the ability to prevent user name spaces, and yet you are OK with
(indeed, touting) /proc/sys/user/max_user_namespaces.

If we set max_user_namespaces to N, won't the N+1'th application get
an error when they try to create a user namespace? One of your
arguments about why having LSM's forcing a error of say, EPERM, is
that applications that don't check for error returns might get
confused. (Those are buggy applications; so they should be fixed ---
isn't that your argument about why we shouldn't be freaking out over
security bugs caused by kernel bugs and user namespaces.) But if you
set max_user_namespaces, that same application will now fail with say,

And if in fact there is a buggy application that will create a
security exposure because they aren't checking !@#@?! error returns,
an attacker can simply create N user namespaces --- and then trigger
the buggy applicaion, at which point, they will have 0wned the system.

- Ted