← Back to team overview

kernel-packages team mailing list archive

[Bug 1555321] Re: kernel should support disabling CLONE_NEWUSER via sysctl


** Changed in: linux (Ubuntu)
   Importance: Undecided => Medium

** Tags added: kernel-da-key

You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.

  kernel should support disabling CLONE_NEWUSER via sysctl

Status in linux package in Ubuntu:

Bug description:
  Unprivileged user namespaces gives an unprivileged user access to a
  large set of kernel functionality and interfaces that has historically
  not been carefully vetted for security issues, as it required a user
  with trusted privileges to access. This has lead to a number of
  security issues around mounting filesystems and other areas of the

  We should give administrators the option to disable unprivileged user
  namespaces via a sysctl if they have no need for it, to allow them to
  reduce their threat surface. The patch at
  http://www.openwall.com/lists/kernel-hardening/2016/01/28/8 does so.
  (debian is currently carrying a similar patch
  default.patch?h=sid ).

To manage notifications about this bug go to: