MIME-Version: 1.0
In-Reply-To: <20160308060657.GA3565@mail.hallyn.com>
References: <CALCETrU4+zTKABz1foEA=an3XYbe_UXxn_w9=1GjVzMe5DXXPw@mail.gmail.com>
 <20160308060657.GA3565@mail.hallyn.com>
From: Andy Lutomirski <luto@amacapital.net>
Date: Tue, 8 Mar 2016 10:31:45 -0800
Message-ID: <CALCETrUx_O7Uiyxjs8H++bAR34dSvWny+HsVzXasCVE9wHFGFA@mail.gmail.com>
Subject: Re: Thoughts on tightening up user namespace creation
To: Serge Hallyn <serge.hallyn@ubuntu.com>
Cc: Stephane Graber <stgraber@ubuntu.com>, Colin Walters <walters@verbum.org>,
        Kees Cook <keescook@chromium.org>,
        Linux Containers <containers@lists.linux-foundation.org>,
        "Eric W. Biederman" <ebiederm@xmission.com>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Seth Forshee <seth.forshee@canonical.com>,
        Alexander Larsson <alexl@redhat.com>
Content-Type: text/plain; charset=UTF-8
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 841
Lines: 17

On Mar 7, 2016 10:06 PM, "Serge E. Hallyn" <serge.hallyn@ubuntu.com> wrote:
>
> On Mon, Mar 07, 2016 at 09:15:25PM -0800, Andy Lutomirski wrote:
> >  - Ubuntu requires CAP_SYS_ADMIN
>
> No, it does not.  It has temporarily re-added a sysctl which can enable
> that behavior, but it's not set by default.  The reason for providing it
> is not a distrust of user namespaces in general, but because we're enabling
> some bleeding edge patches which haven't been accepted upstream yet.  Once
> they're accepted upstream I expect that patch to be dropped again, unless
> it has gone upstream.
>
> Debian does afaik still have a version of a patch I'd originally written
> before user namespaces were upstream which defaulted unprivileged userns
> cloning to off.  Did you mean Debian here?

I meant Ubuntu 14.04, which I tested, possibly poorly.