github-starred/firejail

Fork 0

mirror of https://github.com/netblue30/firejail.git synced 2026-05-15 14:16:14 -06:00

[GH-ISSUE #425] Security Implications for User namespaces #308

New issue

Closed

opened 2026-05-05 05:34:39 -06:00 by gitea-mirror · 3 comments

gitea-mirror commented

2026-05-05 05:34:39 -06:00

Owner

Originally created by @HulaHoopWhonix on GitHub (Apr 10, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/425

User namespaces are described as a particularly risky kernel feature that has allowed privilege escalation in the past. I think its useful to keep around but its probably best avoided in supported profiles.

https://github.com/subgraph/oz/issues/11

Originally created by @HulaHoopWhonix on GitHub (Apr 10, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/425 User namespaces are described as a particularly risky kernel feature that has allowed privilege escalation in the past. I think its useful to keep around but its probably best avoided in supported profiles. https://github.com/subgraph/oz/issues/11

gitea-mirror

2026-05-05 05:34:39 -06:00

closed this issue
added the
information_old
label

gitea-mirror commented

2026-05-05 05:34:44 -06:00

Author

Owner

@netblue30 commented on GitHub (Apr 10, 2016):

User namespace is more like a baseball bat. Imperfect, with its own problems, but works very well in some cases.

Firejail has support to disable various sandboxing features the user might find undesirable. You can do it at compile time (./configure --help) or at run time (man firejail-config). You can disable user namespaces, chroot, and a number of other features. So far I've heard complains about user namespace and networking.

@netblue30 commented on GitHub (Apr 10, 2016): User namespace is more like a baseball bat. Imperfect, with its own problems, but works very well in some cases. Firejail has support to disable various sandboxing features the user might find undesirable. You can do it at compile time (./configure --help) or at run time (man firejail-config). You can disable user namespaces, chroot, and a number of other features. So far I've heard complains about user namespace and networking.

gitea-mirror commented

2026-05-05 05:34:46 -06:00

Author

Owner

@curiosity-seeker commented on GitHub (Apr 10, 2016):

FWIW, user namespaces are not supported by Arch Linux, either, because of security considerations.

@curiosity-seeker commented on GitHub (Apr 10, 2016): FWIW, user namespaces are [not supported](https://bugs.archlinux.org/task/36969) by Arch Linux, either, because of security considerations.

gitea-mirror commented

2026-05-05 05:34:48 -06:00

Author

Owner

@HulaHoopWhonix commented on GitHub (Apr 10, 2016):

Ah OK. You're aware of this topic: and discussed implications: https://github.com/netblue30/firejail/issues/9#issuecomment-129494347

I'll search harder next time :)

@HulaHoopWhonix commented on GitHub (Apr 10, 2016): Ah OK. You're aware of this topic: and discussed implications: https://github.com/netblue30/firejail/issues/9#issuecomment-129494347 I'll search harder next time :)

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#308

No description provided.

Rows
Columns