Linux User Namespaces: A Blessing and a Curse - Security Implications and Best Practices

Explore the controversial topic of unprivileged Linux user namespaces in this conference talk from NDC TechTown in Kongsberg, Norway. Dive into the dual nature of user namespaces - how they enable building unprivileged and sandboxed services following the least privilege principle while simultaneously serving as potential attack vectors for security exploits. Learn about the ongoing debate in the security community regarding whether user namespaces enhance or compromise system security. Examine practical examples of how user namespaces contribute to building secure sandboxed applications, and analyze a recent Linux kernel vulnerability that was amplified due to user namespace availability. Discover practical recommendations for implementing user namespaces effectively - allowing legitimate applications to utilize them for enhanced security while preventing access from potentially malicious sources.