Re: New Linux kernel NetFilter flaw gives attackers root privileges

[Florian Weimer <fweimer () redhat com>]

* Tobias Heider:

> Another thing worth mentioning is that the apparmor team has done some very
> interesting work on providing finer control over unprivileged user namespaces
> on a per application basis:
> https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction
>
> This would allow having opt-in unprivileged userns support only for
> confined and explicitly permitted applications and could hopefully
> drastically reduce the impact of similar bugs in the future.

Doesn't unprivileged chroot need user namespace support?  So a side
effect of disabling it might be to force applications to switch to
userspace emulation of pathname lookup.  That doesn't seem like a good
tradeoff?

Thanks,
Florian