[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <87a5yahp3f.fsf@oldenburg3.str.redhat.com>
Date: Thu, 11 May 2023 17:20:20 +0200
From: Florian Weimer <fweimer@...hat.com>
To: Tobias Heider <tobias.heider@...onical.com>
Cc: oss-security@...ts.openwall.com, Turritopsis Dohrnii Teo En Ming
<tdtemccnp@...il.com>, ceo@...-en-ming-corp.com, Piotr Krysiuk
<piotras@...il.com>
Subject: Re: New Linux kernel NetFilter flaw gives attackers
root privileges
* Tobias Heider:
> Another thing worth mentioning is that the apparmor team has done some very
> interesting work on providing finer control over unprivileged user namespaces
> on a per application basis:
> https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction
>
> This would allow having opt-in unprivileged userns support only for
> confined and explicitly permitted applications and could hopefully
> drastically reduce the impact of similar bugs in the future.
Doesn't unprivileged chroot need user namespace support? So a side
effect of disabling it might be to force applications to switch to
userspace emulation of pathname lookup. That doesn't seem like a good
tradeoff?
Thanks,
Florian
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
