3 ms·
What about older LTS systems that have CLONE_NEWUSER but only allow access to it from uid 0?
by audidude 9y ago
What about older LTS systems that have CLONE_NEWUSER but only allow access to it from uid 0?
- jagger11 9y agoYou can run it as root, and specifiy users/groups to switch to before executing an app. Though, CLONE_NEWUSER was meant for exactly that - using namespaced without euid==0. Some systems like Debian have a sysctl flag: kernel.unprivileged_userns_clone which controls this behavior. Ultimately, it's up to you whether set it to "1", as CLONE_NEWUSER in the past opened many new attack vectors on the Linux kernel. However, I believe that currently the situation is much better, esp. after syzkaller and individual researchers reported and fixed many bugs in this area.