3 ms·
Bubblewrap is indeed most often used without SUID nowadays; in particular, SUID is generally only used if unprivileged user namespaces are unavailable.
by kirbyfan64sos 5y ago
Bubblewrap is indeed most often used without SUID nowadays; in particular, SUID is generally only used if unprivileged user namespaces are unavailable.
- usr1106 5y agoBut unprivileged user namespaces are a risk on their own: Code that is supposed to be unprivileged suddenly runs as uid 0. Well, uid 0 "only" in a non-root namespace, but occasionally there have been vulnerabilities that missed the "only".
- raesene9 5y agoIndeed there have been CVEs this year where code in a user namespace was able to trigger them where a standard unprivileged process could not (e.g. CVE-2022-0185)