Join us at the premier vendor-neutral open source conference, where developers and technologists come together to collaborate, share knowledge, and explore the latest innovations and advancements in open source technology. Learn more at https://events.linuxfoundation.org/
Linux User Namespaces: A Blessing and a Curse - Ignat Korchagin, Cloudflare
Unprivileged Linux user namespaces is a rather controversial topic in the security community and the Kernel community. On one side it allows building unprivileged and sandboxed applications, which would otherwise require elevated privileges to successfully run.
On the other side, this mechanism has been repeatedly used in various vulnerabilities and exploits as an attack vector. And since it became so popular within the offensive industry, many Linux distributions and security guidances started recommending disabling this feature altogether.
There is an ongoing debate whether unprivileged user namespaces provide more security or make the system more vulnerable. In this presentation we will review how user namespaces might help building sandboxed secure applications. But we will also show how a recently discovered Linux kernel bug turned into a security vulnerability just because user namespaces are available on the system. Finally, we will give recommendations on how to get the best of both worlds: allow well-behaved applications to utilize user namespaces for better security, while blocking the feature for potentially malicious users/code.