Linux user namespaces: a blessing and a curse
summary
Unprivileged user namespaces let an ordinary UID map to root inside a namespace and then create mount, pid and network namespaces to run rootless containers and sandboxes (examples: Chrome sandbox, rootless containers, systemd-coredump). That same capability turned old kernel bugs (TC bug from 2019 reproduced in 2022) into remote crash/exploit paths. A practical fix is per-process policy enforcement via BPF LSM hooks (Linux 6.1 user_ns_create), loading BPF programs to allow or deny unprivileged user namespaces for specific binaries; the allowlist approach runs in production.
AI-written summary · about
chapters (14)
- 0:00Linux user namespaces intro
- 1:08Containers and namespaces overview
- 3:55Mount namespaces explained
- 10:23Network namespaces demo
- 15:44PID namespaces deep dive
- 19:21User namespaces privilege mapping
- 21:54Unprivileged user namespaces
- 23:20Why unprivileged namespaces matter
- 26:10Sandboxing with user namespaces
- 29:41Security concerns and bugs
- 33:40Kernel vulnerabilities
- 37:34Balancing security and usability
- 41:48BPF LSM control
- 44:39Summary and best practices
related talks
32mLinux user namespaces: a blessing and a curse
39mLinux User Namespaces: A Blessing and a Curse
54mContainers unplugged: understanding user namespaces
54mUnderstanding user namespaces
01h 03mLinux Namespaces for Fun and Isolation
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
42mWhat's New in the User Namespace
48mState of Linux Kernel Container Features