Restricting Unprivileged User Namespaces in Ubuntu
summary
Ubuntu 24.04 ships a default restriction on unprivileged user namespaces and pairs it with AppArmor policy so sandboxing callers either get a confined profile or are denied. A hybrid design blocks direct unshare/clone for untrusted processes, transitions children to a special AppArmor profile at namespace creation, and uses AA Notify UI for user-approved exceptions. A small LSM patch removes const on creds to set that profile, containers get a per-policy namespace toggle, and about 120 archive apps receive confinement rules so far.
AI-written summary · about
chapters (9)
- 0:00Unprivileged user namespaces
- 4:25Security risks
- 10:50Approaches to restrict namespaces
- 14:09Hybrid LSM and capabilities
- 20:12Sandboxing applications
- 27:23Out-of-archive challenges
- 33:21User-friendly notifications
- 38:26LXD policy conflicts
- 43:31Current state and future
related talks
50mImproving Unmodified Classic Application Confinement
32mLinux user namespaces: a blessing and a curse
47mLinux user namespaces: a blessing and a curse
39mLinux User Namespaces: A Blessing and a Curse
48mUnprivileged Access Control in AppArmor
32mSecurity Namespace: Making Linux Security Frameworks Available to Containers
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
57mNamespaces for Security