2 ms·
It's probably true that there are setuid programs that can be exploited if you run them in a user namespace. You probably need to remove setuid (and setgid) as
by kragen 11mo ago
It's probably true that there are setuid programs that can be exploited if you run them in a user namespace. You probably need to remove setuid (and setgid) as Plan9 did in order to do this.
- josephcsible 11mo agoI meant distros are moving towards no unprivileged user namespaces at all, not just no setuid programs inside them.
- kragen 11mo agoIs "just no setuid programs inside them" even an option?