{"id":110711,"date":"2023-10-10T03:10:26","date_gmt":"2023-10-10T01:10:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/ubuntu-ogranichit-dostup-k-user-namespace"},"modified":"2023-10-10T03:10:26","modified_gmt":"2023-10-10T01:10:26","slug":"ubuntu-ogranichit-dostup-k-user-namespace","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/ubuntu-ogranichit-dostup-k-user-namespace","title":{"rendered":"Ubuntu will restrict access to user namespace","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Canonical has announced changes in Ubuntu 23.10 that limit users' access to user namespace identifiers. This change aims to enhance the security of systems utilizing container isolation against vulnerabilities that exploit user namespace manipulation. According to Google, 44% of exploits participating in the cash reward program for reporting vulnerabilities in the Linux kernel require the ability to create user namespace identifiers. <\/p>\n
Instead of completely blocking access to the user namespace in Ubuntu, a hybrid scheme has been implemented, selectively allowing certain programs to create user namespaces if there is an AppArmor profile with the rule 'allow userns create' or the CAP_SYS_ADMIN privilege. For example, a profile has been created for Chrome at \/etc\/apparmor.d\/opt.google.chrome.chrome, which can serve as a template for granting access to the user namespace for other programs. <\/p>\n
In the upcoming release of Ubuntu 23.10, access restrictions to user namespace are planned to be offered as an option that is disabled by default. Within a few weeks after the release of Ubuntu 23.10, developers will gather information on any potential negative impacts of disabling access to user namespace on package functioning and prepare corresponding AppArmor profiles. Subsequently, in one of the stable release updates, the restriction will be activated by default. <\/p>\n
To enable the restriction early, you can use the following commands: sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 <\/p>\n