Chromes sandbox uses unprivileged namespaces but has a suid-root fallback. Electron apps too (if sandboxing is enabled). Bubblewrap (used by flatpack, idk. ab

Chromes sandbox uses unprivileged namespaces but has a suid-root fallback. Electron apps too (if sandboxing is enabled). Bubblewrap (used by flatpack, idk. about snap) prefers user namespaces, too. All of them could can have suid fallbacks they would prefer to not have. Tbh. if Linux had a proper capability system it probably would make sense to attach a "user ns" capability to binaries which in the past used suid-root for namespaces and not allow "other" processes to use it. > there's little point in enforcing a separation between users and root I don't agree. But it is a different discussion. (And a complicated discussion too as Linux desktop is IMHO currently lacking in various security areas as security requirements have changed. So often when you argue they should do this you get non productive answers like "oh but you also could do [that other think which also need to change sooner or later]". Anyway it can make the difference between it being easily able to steal all password from your password manager and it only being able to steal the passwords you did use since infection. Or it being able to steel a early boot full disk encryption key. etc. etc.)