Linux User Namespaces - A Blessing and a Curse

Explore the controversial topic of unprivileged Linux user namespaces in this 39-minute conference talk that examines both the security benefits and risks of this kernel feature. Delve into how user namespaces enable the creation of unprivileged and sandboxed applications that would otherwise require elevated privileges, while also understanding why this mechanism has become a popular attack vector in various vulnerabilities and exploits. Learn about the ongoing debate in the security and kernel communities regarding whether unprivileged user namespaces enhance system security or increase vulnerability. Discover practical examples of how user namespaces can help build secure sandboxed applications, and examine a case study of a recently discovered Linux kernel bug that became a security vulnerability specifically due to the availability of user namespaces. Gain valuable insights into recommended strategies for maximizing the security benefits of user namespaces while mitigating potential risks, including approaches to allow legitimate applications to utilize this feature while blocking access for potentially malicious users or code.