Re: [PATCH 0/2] userns: keep the exec securebits

[Serge E. Hallyn]

On Mon, Oct 26, 2026 at 09:53:28PM +0100, Christian Brauner wrote:
> The exec securebits are meant to be set and locked by a service manager
> so that nothing below it can turn them off again. But creating a user
> namespace resets all securebits, locks included. So anyone who may
> create a user namespace can shed them with a single
> unshare(CLONE_NEWUSER), and joining one with setns() does the same.
> That's pretty much everyone.
> 
> systemd gains a SecureBits= setting for the service manager itself. It
> sets and locks the exec bits for everything it starts, so interpreters
> that support AT_EXECVE_CHECK enforce the system's execution policy for
> their scripts. With the reset "unshare -U python3 /tmp/x.py" gets
> around all of that.
> 
> The other securebits are about how capabilities are computed and
> resetting them in a new user namespace is fine. The exec bits grant
> nothing. They're restrictions a task placed on itself, like
> no_new_privs, which a user namespace doesn't drop either. So keep them
> and their locks and keep resetting the rest.
> 
> I also keep the exec bits that aren't locked. fork() and execve()
> preserve them and the task can clear them itself anyway, so dropping
> them on unshare() would just be inconsistent.
> 
> The new selftests fail on mainline and pass with the fix. I think this
> wants to go to stable, otherwise the locks don't mean much on any kernel
> that has these bits.
> 
> Signed-off-by: Christian Brauner (Amutable) <brauner@xxxxxxxxxx>

thanks, makes sense to me.

Reviewed-by: Serge Hallyn <serge@xxxxxxxxxx>

for both.

> ---
> Christian Brauner (2):
>       userns: don't drop the exec securebits
>       selftests/exec: check that user namespaces keep the exec securebits
> 
>  Documentation/userspace-api/check_exec.rst |  4 ++
>  kernel/user_namespace.c                    |  5 +-
>  tools/testing/selftests/exec/check-exec.c  | 83 ++++++++++++++++++++++++++++++
>  3 files changed, 91 insertions(+), 1 deletion(-)
> ---
> base-commit: 21a7f44fd0765fcc5194130b28767786eba1d1e7
> change-id: 20261026-work-securebits-userns-6070b18a9cda