Unprivileged User Namespace

From Kicksecure
Jump to navigation Jump to search

Unprivileged user namespaces (userns) are a feature in the Linux kernel that enable non-root users to create isolated environments. While userns can enhance security for certain applications using userns-based sandboxes, userns also increases the kernel's attack surface, posing security risks. This article explores the consequences of disabling unprivileged user namespaces and provides a step-by-step guide for implementing this security measure in Kicksecure.

Introduction[edit]

security-misc has an Optional Feature to disable unprivileged user namespaces mentioned in security-misc readmearchive.org.

See also:

Consequences of Disabling Unprivileged User Namespace[edit]

Disabling unprivileged user namespaces breaks:

HowTo: Disabling Unprivileged User Namespace[edit]

1. Create a new sysctl configuration file.

Open file /etc/sysctl.d/50_user.conf in an editor with root rights.

Kicksecure

See Open File with Root Rights The Web Archive Onion Version for detailed instructions on why to use sudoedit for better security and how to use it.

Note: Mousepad (or the chosen text editor) must be closed before running the sudoedit command.

sudoedit /etc/sysctl.d/50_user.conf

Kicksecure for Qubes

NOTES:

sudoedit /etc/sysctl.d/50_user.conf

  • After applying this change, shutdown the Template.
  • All App Qubes based on the Template need to be restarted if they were already running.
  • This is a general procedure required for Qubes and unspecific to Kicksecure for Qubes.

Others and Alternatives

  • This is just an example. Other tools could achieve the same goal.
  • If this example does not work for you or if you are not using Kicksecure, please refer to this link.

sudoedit /etc/sysctl.d/50_user.conf

2. Paste sysctl settings.

kernel.unprivileged_userns_clone=0 user.max_user_namespaces=0

3. Save.

4. Reboot required. [1]

5. Done.

SUID[edit]

Using SUID instead is also not a suitable alternative. SUID is also a risk. (Hence, SUID Disabler and Permission Hardener exists.)

This mode is not recommended, and some Flatpak apps and features will not work.

[...]

This is a security trade-off. Disallowing unprivileged use of user namespaces reduces the kernel's attack surface, which mitigates some attacks; but it also disallows some sandboxing techniques, which prevents other attacks from being mitigated. Making bwrap or flatpak-bwrap setuid root also carries some risk: an attacker might be able to exploit vulnerabilities in bwrap to achieve root privilege escalation.flatpak wiki, chapter Setuid bubblewraparchive.org

Therefore Kicksecure does not use suid-root bubblewrap.

Future[edit]

Access to unprivileged user namespaces have become too much of a security threat for Ubuntu. The upstream AppArmor project recently introduced a mechanism 49 to allow the use of unprivileged user namespaces to only those applications that both require the access and are appropriately confined by AppArmor (and to deny access to all other applications)AppArmor unprivileged user namespace restrictions in Ubuntu 23.10archive.org

Kernel parameter kernel.apparmor_restrict_unprivileged_userns=0 is unfortunately Ubuntu-specific, hence not re-usable by Kicksecure.

Without this security hardening, all locally running applications could use user namespaces (userns) and attempt to exploit them for user-to-root escalation. With this hardening, userns usage is restricted to specific applications such as Chromium that explicitly require it.

However, even with all of this hardening in place, as described in Chrome sandbox escapearchive.org, if the browser gets exploited, the browser is allowed to use userns and the system remains vulnerable to userns-based attacks.

Given that browsers are evolving into operating systems where users do almost everything, the effective security gain from these measures is not as significant as it might seem. Nowadays, Java isn't the "write once, run anywhere" framework we all rely on. The browser is.

Therefore, completely disabling user namespaces using user.max_user_namespaces=0 is the safer setting.

Related[edit]

Discussions[edit]

Footnotes[edit]

  1. ↑ Or apply sysctl.
Your support makes
all the difference!

We believe security software like Kicksecure needs to remain Open Source and independent. Would you help sustain and grow the project? Learn more about our 12 year success story and maybe DONATE!

Retrieved from "https://www.kicksecure.com/w/index.php?title=User_Namespace&oldid=90573"