Re: [PATCH] Add ability to disallow idmapped mounts
"Anton V. Boyarshinov" <[email protected]>
| Newsgroups | com.openwall.lists.kernel-hardening,org.kernel.vger.linux-fsdevel,org.kernel.vger.linux-kernel |
|---|---|
| Organization | ALT Linux |
| Message-ID | <20220204132616.28de9c4a@tower> |
В Fri, 4 Feb 2022 10:45:15 +0100 Christian Brauner <[email protected]> пишет: > If you want to turn off idmapped mounts you can already do so today via: > echo 0 > /proc/sys/user/max_user_namespaces It turns off much more than idmapped mounts only. More fine grained control seems better for me. > They can neither > be created as an unprivileged user nor can they be created inside user > namespaces. But actions of fully privileged user can open non-obvious ways to privilege escalation.