3 ms·
user namespaces are a super rad feature. They've protected us at $WORK from multiple vulnerabilities that have come out.
by sargun 7y ago
user namespaces are a super rad feature. They've protected us at $WORK from multiple vulnerabilities that have come out.
- londons_explore 7y agoHow do you use them? Are we talking about developer desktop PC's here? Or user namespaces as part of a containerization setup? The main use of user namespaces seems to be running stuff that wants to be root as non-root. It would seem better to simply fix all those tools to not check if they are root, and instead just try to do the thing they were trying to do.
- woadwarrior01 7y agoFor developer desktops, there's firejail[1]. [1]: https://github.com/netblue30/firejail https://github.com/netblue30/firejail
- AdrienLemaire 7y agoLovely! Thanks for sharing this awesome-looking tool :) edit: oh, it's also mentioned in the document slide 53 along with Flatpak
- sjy 7y agoCould you provide a little more detail? I’ve recently disabled user namespacing on an app I’ve deployed because I couldn’t figure out how to create an encrypted volume from within the container [1]. I think I understand the security implications and I’m comfortable with them, but I’d be really interested to know how user namespacing has saved people from real vulnerabilities in the real world. [1] https://unix.stackexchange.com/questions/557293/how-can-i-make-a-device-available-inside-a-systemd-nspawn-container-with-user-na https://unix.stackexchange.com/questions/557293/how-can-i-ma...