User namespaces (unpriviledged)

[Chrisdb]

Hello,

I've been reading about unpriviledged user namespaces and apparently the use of it is considered unsafe. It can make vulnerabilities in the Linux kernel more easily exploitable.

Is this still true with the kernel of the latest version of Debian?

Thanks

[Chrisdb]

Apparently since the release of Bullseye, it is enabled by default (https://www.debian.org/releases/bullsey ... namespaces):

Code: Select all

The previous Debian default was to restrict this feature to processes running as root, because it exposed more security issues in the kernel. However, as the implementation of this feature has matured, we are now confident that the risk of enabling it is outweighed by the security benefits it provides.