Received-SPF: pass (google.com: domain of oss-security-return-30029-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Date: Mon, 15 Apr 2024 16:32:02 +0100
From: Simon McVittie <smcv@debian.org>
To: oss-security@lists.openwall.com
Message-ID: <Zh1IcvB2TL4dItr9@remnant.pseudorandom.co.uk>
References: <20240414190855.GA12716@openwall.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240414190855.GA12716@openwall.com>
Subject: Re: [oss-security] Linux: Disabling network namespaces

On Sun, 14 Apr 2024 at 21:08:55 +0200, Solar Designer forwarded:
> Some other container runtimes such as Docker and Podman do make use
> of network namespaces by default.

As an example of a less traditional container environment, Flatpak
optionally uses network namespaces (as implemented by bubblewrap,
bwrap(1)) to isolate apps from the network, and disabling
network namespaces will break the ability to run apps that have
`--unshare=network` in their manifests. I believe it will "fail closed"
in this situation (refusing to run the affected app, rather than running
the app but giving it unintended network access).

A workaround would be to run the affected apps with
`flatpak run --share=network ...`, or permanently reconfigure their
sandboxing parameters with `flatpak override --share=network ...`, but
either of those workarounds would remove the network isolation feature
and give the affected apps unrestricted network access.

Similarly, libgnome-desktop uses bubblewrap to run sandboxed thumbnailers
with no network access, mitigating vulnerabilities that might exist in
thumbnailers or the libraries that they use. Again, I believe it will
"fail closed", but I haven't checked.

Similarly, WebKitGTK uses bubblewrap to sandbox parts of itself with no
network access, xdg-desktop-portal uses bubblewrap for sandboxed icon
validation, and I'm sure there are others.
(<https://codesearch.debian.net/search?q=--unshare-net>)

So I suspect that the mitigation of disabling network namespaces is
likely to be too disruptive to be applicable on desktops, and only useful
on servers.

    smcv