2

This question already has an answer here:

Linux user namespaces are special, as they play the role of the owner of the other namespaces.

Distributions (Debian, Ubuntu, Arch, ...) seem to ship with unprivileged user namespaces disabled.

For example, when podman is run as non-root user and unprivileged user namespaces are disabled, one gets a notice like this:

user namespaces are not enabled in /proc/sys/kernel/unprivileged_userns_clone

It is easy to enable unprivileged user namespaces.

In which context it would be safe to enable them?

marked as duplicate by forest, Xander, MechMK1, Benoit Esnard, multithr3at3d Aug 1 at 0:24

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Your premise disagrees with my Ubuntu 18.04 installation. $ cat /proc/sys/kernel/unprivileged_userns_clone 1 . I can create a user namespace: $ unshare -Ur # – domen Jun 10 at 15:27
  • Confirmed, it seems the defaults have changes over time. – miku Jun 10 at 18:52
  • Very unsafe... Unprivileged userns is a boon for exploits. – forest Jul 30 at 1:09

Browse other questions tagged or ask your own question.