Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
This message was sent to my websocket:
echo kernel.unprivileged_userns_clone = 1 | sudo tee /etc/sysctl.d/00-local-userns.conf
Is it dangerous, and what would it do?
Thanks for your feedback everyone, chances are it was someone trying to install the Brave Browser who accidentally pasted into the wrong box and I'm overreacting.
Enabling unprivileged user namespaces opens up severe vulnerabilities in the Linux kernel. If you did not intend to enable it, you should ensure it is disabled. Numerous vulnerabilities that are found regularly are often only exploitable if unprivileged user namespaces are supported and enabled by the kernel.
It disables a bit of "hardening" that Debian patches into their distribution kernel. If you're not running such a kernel, it will fail and not do anything, as such a setting doesn't even exist in the mainline Linux kernel. If you were running such a patched kernel, all it would do is disable the functionality of that patch, and let your kernel work like every other kernel, allowing unprivileged users to use unshare -U. Contrary to forest's answer, I don't believe this to be dangerous. In particular, if a user can sudo to root (as would be required to turn this off), they can already do everything that this would let them do.
