3 ms·

I see no mention of "userns" in debian's apparmor.d, which means Debian is unaffected because it does not implement such protection at all. An analogy: Ubuntu

by theamk 2y ago

I see no mention of "userns" in debian's apparmor.d, which means Debian is unaffected because it does not implement such protection at all. An analogy: Ubuntu has installed a lock on a window which turned out to be easily broken. Debian was unaffected because it just kept that window unlocked - no lock, no vulnerability.

curt15 2y ago
Fedora and RHEL 8+ also don't restrict unprivileged user namespaces. They are required for flatpak and rootless podman, both widely used and promoted technologies in the Red Hat ecosystem.
- fpoling 2y ago
  Flatpack does not require user namespaces. bubblewrap, the tool Flatpack uses to secure things, can be installed set-uid and can then setup the sandbox without the user namespaces. Chromium-based browsers also include own setuid tool to setup the sandbox if the user-namespaces are not available. Even podman could have used something like that. But I guess RedHat assumes that the user namespaces are solid these days are do not bother…
- worthless-trash 2y ago
  > Fedora and RHEL 8+ also don't restrict unprivileged user namespaces. Are you sure ? Its disabled by default boot on my systems.
udev4096 2y ago
Debian is still way worse. Do not use it. Instead, stick to fedora or arch
- eqvinox 2y ago
  If you post something like this, you need to have arguments and links in it. No matter how well founded your opinion might be, noone knows what solid basis you have (or don't) and as such your comment is just badmouthing.
j45 2y ago
Appreciate it, I understand the same.