Contents
Do you need to enable unprivileged user namespace?
If you did not intend to enable it, you should ensure it is disabled. Numerous vulnerabilities that are found regularly are often only exploitable by unprivileged users if unprivileged user namespaces are supported and enabled by the kernel.
What does enabling kernel.unprivileged _ userns _ clone do?
Numerous vulnerabilities that are found regularly are often only exploitable by unprivileged users if unprivileged user namespaces are supported and enabled by the kernel. Unless you truly need it, just disable it.
How to disable user namespaces in Linux kernel?
Unfortunately, it is still quite insecure (in part due to the lack of CVE reporting for security bugs in the Linux kernel). If that is the case for your particular distro, you can disable user namespaces directly by setting user.max_user_namespaces = 0.
Why are user namespaces always enabled in Debian?
This Debian-specific patch has been refused by the Linux kernel developers. Because you are not using a Debian provided kernel, user namespaces are always enabled and you do not need to set a sysctl to turn them on. You can simply skip this step. For checkpoint/restore, install criu and run criu check.
Why does a kernel need a UID of 0?
The reason for this is that much of the kernel that is only intended to be reachable by UID 0 is not audited particularly well, given that the code is typically considered to be trusted. That is, a bug that requires a UID of 0 is rarely considered a serious bug.
Can a process have full privileges outside the namespace?
In particular, a process can have a normal unprivileged user ID outside a user namespace while at the same time having a user ID of 0 inside the namespace; in other words, the process has full privileges for operations inside the user namespace, but is unprivileged for operations outside the namespace.