Linux User Namespaces: A Blessing and a Curse
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
Explains how unprivileged user namespaces let an unprivileged account map to root inside a namespace (useful for rootless containers) but also expose kernel privilege-path bugs that became exploitable—one reproduced a kernel crash that took down a Kubernetes cluster and became CVEs. Describes practical mitigations: kernel config/sysctls to disable, and a working policy built with BPF LSM that attaches a new security hook upstream (Linux ~6.2) implementing an allow list of services allowed to create namespaces; deployed policy is small and effective.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:26Linux namespaces and containers
- 2:32Mount namespaces in containers
- 7:09Network namespaces and veth pairs
- 11:02PID namespaces and isolation
- 13:53User namespaces and privilege mapping
- 16:02Unprivileged namespaces security
- 21:47Real-world unprivileged namespace apps
- 22:31Kernel bug escalation via namespaces
- 26:06Disabling vs securing namespaces
- 28:12BPF LSM policy enforcement
- 33:10BPF LSM policy for namespaces
- 35:40Summary
related talks
32mLinux user namespaces: a blessing and a curse
47mLinux user namespaces: a blessing and a curse
40mUser Namespaces in Kubernetes: Security and Flexibility - Pick Both
21mMaking Kubernetes Safer with User Namespaces
25mIsolate the Users! Supporting User Namespaces in K8s for Increased Security
54mUnderstanding user namespaces
54mContainers unplugged: understanding user namespaces
01h 03mLinux Namespaces for Fun and Isolation