Re: [PATCH] userns/capability: Add user namespace capability

Am 18.10.2015 um 23:49 schrieb Tobias Markus:

But before we continue arguing endlessly, I just got an idea: What about
adding a sysctl to enable/disable enforcement of the hypothetical
CAP_SYS_USER_NS, just like with /proc/sys/kernel/kptr_restrict and
CAP_SYSLOG? Would also prevent any potential userspace breakage.

My argument stands, hiding user namespaces behind whatever
switch and rendering it into a second class citizen does not improve its security.

Especially ad-hoc solutions are not expedient. Reducing the attack surface must not
lead to gazillions of new capabilities, sysctl switches, etc...
user namespaces are neither the first nor the last "critical" kernel feature.

I'm sure RHEL will ship a SELinux boolean to disable user namespaces as they do
for many other OS features. This is fine and exactly why we have LSM.

Thanks,
//richard