3 ms·
Is there a reason why user namespaces cannot be enabled per executable? setcap "something something user ns" /usr/bin/chrome?
by frankjr 3y ago
Is there a reason why user namespaces cannot be enabled per executable? setcap "something something user ns" /usr/bin/chrome?
- kentonv 3y agoIn theory that might work. In practice, it doesn't help much; you might as well stick with setuid-root. * The mechanism for granting capabilities to binaries is convoluted, requiring special tools, filesystem support, and fiddly code. It's surprisingly tedious to make it work. * There's no specific capability for user namespaces. When they require privileges at all, they require CAP_SYS_ADMIN. This capability is basically equivalent to root anyway. In fact, many Linux capabilities can easily be escalated to full root privileges. My personal opinion is that Linux "capabilities" are not worth using most of the time. (I also hate that they are called "capabilities", a word that I would rather reserve for object-capabilities, which are an actually-useful security model!)