Canonical has announced changes in Ubuntu 23.10 that limit users' access to user namespace identifiers. This change aims to enhance the security of systems utilizing container isolation against vulnerabilities that exploit user namespace manipulation. According to Google, 44% of exploits participating in the cash reward program for reporting vulnerabilities in the Linux kernel require the ability to create user namespace identifiers.
Instead of a complete block on access to user namespace, Ubuntu implements a hybrid scheme that selectively allows certain applications to create user namespaces if they have an AppArmor profile with the rule "allow userns create" or the CAP_SYS_ADMIN privilege. For example, a profile for Chrome has been created at /etc/apparmor.d/opt.google.chrome.chrome, which can be used as a template for granting access to user namespace for other applications.
In the upcoming release of Ubuntu 23.10, access restrictions to user namespace are planned to be offered as an option that is disabled by default. Within a few weeks after the release of Ubuntu 23.10, developers will gather information on any potential negative impacts of disabling access to user namespace on package functioning and prepare corresponding AppArmor profiles. Subsequently, in one of the stable release updates, the restriction will be activated by default.
To enable the restriction early, you can use the following commands: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1
And to disable it: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
Source: opennet.ru
