Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 11 May 2023 17:20:20 +0200
From: Florian Weimer <>
To: Tobias Heider <>
Cc:,  Turritopsis Dohrnii Teo En Ming
 <>,,  Piotr Krysiuk
Subject: Re: New Linux kernel NetFilter flaw gives attackers
 root privileges

* Tobias Heider:

> Another thing worth mentioning is that the apparmor team has done some very
> interesting work on providing finer control over unprivileged user namespaces
> on a per application basis:
> This would allow having opt-in unprivileged userns support only for
> confined and explicitly permitted applications and could hopefully
> drastically reduce the impact of similar bugs in the future.

Doesn't unprivileged chroot need user namespace support?  So a side
effect of disabling it might be to force applications to switch to
userspace emulation of pathname lookup.  That doesn't seem like a good


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.