oss-sec mailing list archives
Re: Re: Linux: Disabling network namespaces
From: John Johansen <john.johansen () canonical com>
Date: Mon, 29 Apr 2024 12:07:23 -0700
On 4/19/24 12:01, nightmare.yeah27 () aceecat org wrote:
On Wed, Apr 17, 2024 at 09:52:10AM GMT, Georgia Garcia wrote:I just wanted to add that in the Ubuntu Noble Numbat release we are using AppArmor to restrict unprivileged user namespaces.Applications that don't have an AppArmor profile will use a default profile which denies the use of capabilities within the user namespace. Applications that need to use capabilities will have to be confined by a profile. Since we understand that creating an AppArmor profile might not be a trivial task for large programs, we introduced the "unconfined" flag which makes the profile act as if it were unconfined from the perspective of AppArmor, allowing all operations.There are more details here:https://discourse.ubuntu.com/t/noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions-13I wonder if this (at least the kernel part of it) is already in the latest PopOS rolling updates? I see some nodes in /proc/sys/kernel that look very related.
partially. The ability to straight up deny user namespace creation is in the kernel already. The ability to transition the profile and the default behavior for unconfined is not. In Ubuntu the behavior for the unconfined profile is hard coded as there is still some work to be done around allowing this to be replaced easily in policy (its possible but has some limitations/costs that were not acceptable). Once the work to make replacing unconfined easy is done that will be upstreamed and the hard coded behavior will get dropped.
Current thread:
- Re: Linux: Disabling network namespaces, (continued)
- Re: Linux: Disabling network namespaces Simon McVittie (Apr 21)
- Re: Linux: Disabling network namespaces Priedhorsky, Reid (Apr 22)
- Re: Linux: Disabling network namespaces Solar Designer (Apr 21)
- Re: Linux: Disabling network namespaces Jordan Glover (Apr 22)
- Re: Linux: Disabling network namespaces Demi Marie Obenour (Apr 23)
- Re: Linux: Disabling network namespaces Simon McVittie (Apr 23)
- Re: Linux: Disabling network namespaces John Johansen (Apr 29)
- Re: Linux: Disabling network namespaces Simon McVittie (Apr 21)
- Re: Linux: Disabling network namespaces Solar Designer (Apr 21)
- Re: Re: Linux: Disabling network namespaces John Johansen (Apr 29)
- Re: Linux: Disabling network namespaces Demi Marie Obenour (Apr 16)