Received-SPF: pass (google.com: domain of oss-security-return-30037-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Feedback-ID: iac594737:Fastmail
Date: Tue, 16 Apr 2024 19:13:50 -0400
From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: oss-security@lists.openwall.com
Message-ID: <Zh8GMOtfoUOZPILD@itl-email>
References: <CAN+za=Opi5h4o1vi1pgqf7NikTQAhZ5tYPHqU+Quwv4WUZdxMQ@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="/f77bwQcLX6RBsLo"
Content-Disposition: inline
In-Reply-To: <CAN+za=Opi5h4o1vi1pgqf7NikTQAhZ5tYPHqU+Quwv4WUZdxMQ@mail.gmail.com>
Subject: Re: [oss-security] Linux: Disabling network namespaces

--/f77bwQcLX6RBsLo
Content-Type: text/plain; protected-headers=v1; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
Date: Tue, 16 Apr 2024 19:13:50 -0400
From: Demi Marie Obenour <demi@invisiblethingslab.com>
To: oss-security@lists.openwall.com
Subject: Re: [oss-security] Linux: Disabling network namespaces

On Tue, Apr 16, 2024 at 11:31:43PM +0200, Philippe Cerfon wrote:
> Hey.
>=20
> There's even an allegedly "wontfix" bug of mine where I requested that
> Debian switches back to a secure default and disables user namesapce which
> have a long history of being exploitable:
> https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1012547
>=20
> Don't think the current hole one will have been the last one.
>=20
> Unfortunately it seems a feature that only a group of people will need is
> valued more important than keeping users secure. :-(

The problem with disabling unprivileged userns is that in the desktop
Linux case it actually causes serious problems, because creating a
sandbox is now a privileged operation.  IMO Landlock + seccomp is a much
better solution for sandboxing, but I don't think it can do everything
browsers need yet.

For containers, I'm not aware of a good solution right now.
--=20
Sincerely,
Demi Marie Obenour (she/her/hers)
Invisible Things Lab

--/f77bwQcLX6RBsLo
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEdodNnxM2uiJZBxxxsoi1X/+cIsEFAmYfBjAACgkQsoi1X/+c
IsEWmhAAkAXDK8vmAZCQXYgTeJNVkYgvxaMH7HDUMrGlFiiRiQUKyeiEs1iFC0+m
rQe/aEurDX8/RX9NHQmki66KVCsDqWaQJG4f9txA7zmJU61eUTQUqs32oI20xWzS
Ii6MOS/3EEzEWVP8trXLguYHidkwLcz0nHZfFdYdRvxMBT6of4oxQQLAI/R78Fc1
8vuFg4bPeHxIa4b/QBk0YA/FuCNvKWgOkUiCVumEpFgGQNq5x2XwxQsw66YuA9kM
1i3vSktZ6b6gz2KxFYcBCZ8EZg5txWiy9vRYgk8gosdGRjB3m2rCgbU+2bv9yJ0a
XjBf0Gh3GJMGu1j4+LL6qgsFd5UFOxyR7oXdkPa6VFiuqyNg/x+GYyurvuN8FkSU
UuCrWb62OcOVMEnclJj4klMwonYxYxxkLEfB335jxrN6SQV6rNfhNzVxmBmMYxYc
3Ce+7cA5VU5uz/ArJKe8ga+HhxN23LPc8gfs17PVa8LE4e21e5zArX92QnbfipHh
pm7qy9wJvdb3ObhVhUkvMIx+BbTYlh3+R6ePPHzlgHaVwE5M5JO1HM7rZn/j2ViJ
gHfXFWt/ePBonHxw/6CE4kL7Fgu9PjNcwSFK+pNZKkXOhTFMMALVNHrGfafhNZmX
aj8WNIYSa4VyS9gyhZs5lgf7TVTq4/iJK5LpbGly1Fb39oR163E=
=JBZt
-----END PGP SIGNATURE-----

--/f77bwQcLX6RBsLo--