0

user namespaces in Linux are presented as a security feature, which should increase security. But is this really true?

Is it possible that while user namespaces fix one kind of problem, they introduce another, unexpected, problem with potential vulnerabilities? If nothing else, namespaces are fantastically complicated structures, and adding them to kernel makes the kernel more complex.

Consider the example of chroot jail, which some application used to increase security. And here is beautiful example how chroot jail actually introduced a local privilege escalation bug:

CVE-2020-7468: TURNING IMPRISONMENT TO ADVANTAGE IN THE FREEBSD FTPD CHROOT JAIL https://www.zerodayinitiative.com/blog/2020/12/21/cve-2020-7468-turning-imprisonment-to-advantage-in-the-freebsd-ftpd-chroot-jail

I like minimalist approach to security: features and services that are not needed should be disabled.

In a situation where I actually don't need user namespaces, such as on my personal machine, would I be better off by disabling them in the kernel? I am not using docker on my machine, and as far as I know, browsers (chromium, firefox) only use PID and network namespaces, not user namespaces.

Improve this question

1 Answer 1

Reset to default
2

In general each added feature adds complexity and each added complexity increases the attack surface.

How much complexity is actually added depends both on the feature but also on the design of the overall system. Linux namespaces are a comparably intrusive feature which affects lots of subsystems. It is also added into a monolithic kernel design (compared for example to a microkernel architecture) and thus any bugs (both security and stability) will affect the whole kernel.

On the other hand namespaces add some useful and comparably lightweight security features. So it gets cheaper to add meaningful security by isolating different parts of applications like in a micro service architecture. This could have been achieved before with distributing the services over virtual machines or even different hardware appliances, which achieves stronger isolation but with significantly more overhead. Or it could have been achieved before with user and process isolation, which provides less isolation than namespaces for similar costs.

This means that by using namespaces one might actually add more security to a system since it now got more cost effective compared to virtual machines or similar. This benefit might outweigh the added complexity and increased attack surface. Or maybe not, depending if the feature gets actually sufficiently used. Because available but unused feature only increase complexity and attack surface (and instability) without providing an actual benefit.

would I be better off by disabling them in the kernel?

Disabling unused features sounds nice at first, but this means that running a system configuration maybe nobody has actually thoroughly tested before. If it is not well established to run such a minimal system, then disabling features might actually introduce new security bugs since there were implicit dependencies on the disabled feature nobody realized before. So, unless disabling the feature is actually established and well tested, I would recommend against doing it just for your environment.

If you care about a minimal system then it is likely better to use a system which is designed to be minimal from start, not a system were you remove commonly used features to be more minimal.

Improve this answer
3
  • apart from docker and flatpacks, do any applications that I might run on my user machine actually use user namespaces ? In other words, If I don't use docker, will any application actually be able to use user namespaces?
    – Martin Vegter
    Jan 10 at 6:36
  • 1
    @400theCat: I don't know anything about your specific system. But user namespaces are not only used in docker but might also be used in other container environments which might be used in your system without you being aware (i.e. snap, flatpak, systemd ...). Like I said, if your system is not designed and well tested to be run without user namespaces than removing the feature might actually lead to new bugs.
    – Steffen Ullrich
    Jan 10 at 6:43
  • 1
    @400theCat Most don't. Simply because it's not all that useful for applications to use. They would rather use seccomp. However, I've used it to create VPNs without privilege - because once you create a user namespace, you're root and you can do a whole bunch of root things within the namespace (like making other kinds of namespaces, like making network namespaces, that you can attach your VPN to). In fact this is where a lot of the user namespace attack surface comes from - rather than the user namespaces themselves.
    – user253751
    Jan 11 at 11:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .