5 ms·
>It doesn't It does require one if your system doesn't support user namespaces. Some distros used to disable it, but they're getting rare these days.
by rockdoe 4y ago
>It doesn't
It does require one if your system doesn't support user namespaces. Some distros used to disable it, but they're getting rare these days.
- staticassertion 4y agoReally? That's surprising, I thought they already dropped the setuid requirement when they implemented the bpf sandbox.
- rockdoe 4y agoYou can probably still have a meaningful bpf sandbox even without the setuid root helper (or user namespaces), but I'm not sure Chrome supports running that way (because it doesn't make much sense from a security tradeoff point of view). As ugly as it is, the odds of a bug in the setuid helper are probably smaller than the odds of a bug in the attack surface its mitigations remove. But the setuid helper and user namespaces are used for other mitigations that can't be done through bpf. The guys who wrote the bpf sandbox have some nice articles about the distinction which you can probably Google.
- account42 4y agoOTOH user namespaces also greatly increase the attack surface. Earlier this year they gave us CVE-2022-0185.