3 ms·
AIU the cause is Netfilter API that doesn't sanitize its input, because only root can call it, so there is no need to sanitize. Then unprivileged user namespace
by GoblinSlayer 3y ago
AIU the cause is Netfilter API that doesn't sanitize its input, because only root can call it, so there is no need to sanitize. Then unprivileged user namespaces open all root API to unprivileged user, so nonsanitizing Netfilter API became available to unprivileged user.
- 1oooqooq 3y agothat's my point. why from a point users didn't have access to netfiltet now gives users access to netfilter? from a command which should be adding more restraint no less. also people focus on this only being a problem now with priv escalation... but all that was always a problem before unprivileged containers... by allowing container code to exploit host kernel code, but nobody called it a privilege escalation then because you started your container as root. sigh.