Linux user namespaces: a blessing and a curse
summary
Explains that unprivileged Linux user namespaces let unprivileged processes map to root and sandbox apps (rootless containers, Chrome tab sandboxes, systemd core processing) but also make ordinary kernel bugs into CVEs: a Cloudflare reproducer crashes kernels when run inside a user+net namespace so one ping crash escalates privilege. Builds a working policy using BPF LSM to deny namespace creation by untrusted binaries while allowing trusted ones, demonstrates the reproducer, shows mount/net/pid examples and that the BPF policy actually blocks the exploit.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:08Containers with namespaces
- 5:45Mount namespaces
- 6:49Network namespaces
- 9:14Process namespaces
- 11:46User namespaces
- 15:41Unprivileged user namespaces
- 18:11Security warnings
- 23:50LSM policies
- 27:45BPF LSM
- 29:52Sandboxing risks
- 30:36Q&A
related talks
47mLinux user namespaces: a blessing and a curse
39mLinux User Namespaces: A Blessing and a Curse
54mUnderstanding user namespaces
01h 03mLinux Namespaces for Fun and Isolation
54mContainers unplugged: understanding user namespaces
42mSandboxing a Linux application
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
50mLinux Security and How Web Browser Sandboxes Really Work