diff options
author | Joachim Fasting <joachifm@fastmail.fm> | 2017-04-30 14:41:56 +0200 |
---|---|---|
committer | Joachim Fasting <joachifm@fastmail.fm> | 2017-04-30 15:17:27 +0200 |
commit | a1678269f93d40f334798fb166956733f528d70d (patch) | |
tree | 902d74a96f77e2ea98b4fa3f07e843fe3d3ad453 /nixos/modules/profiles | |
parent | 86fe3e9c6e7fe35f4db20446ce425e9cb8cf5d13 (diff) | |
download | nixlib-a1678269f93d40f334798fb166956733f528d70d.tar nixlib-a1678269f93d40f334798fb166956733f528d70d.tar.gz nixlib-a1678269f93d40f334798fb166956733f528d70d.tar.bz2 nixlib-a1678269f93d40f334798fb166956733f528d70d.tar.lz nixlib-a1678269f93d40f334798fb166956733f528d70d.tar.xz nixlib-a1678269f93d40f334798fb166956733f528d70d.tar.zst nixlib-a1678269f93d40f334798fb166956733f528d70d.zip |
nixos/hardened profile: disable user namespaces at runtime
Diffstat (limited to 'nixos/modules/profiles')
-rw-r--r-- | nixos/modules/profiles/hardened.nix | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/nixos/modules/profiles/hardened.nix b/nixos/modules/profiles/hardened.nix index c7f80fe47aac..8bde2e4f4984 100644 --- a/nixos/modules/profiles/hardened.nix +++ b/nixos/modules/profiles/hardened.nix @@ -47,4 +47,16 @@ with lib; # ... or at least apply some hardening to it boot.kernel.sysctl."net.core.bpf_jit_harden" = mkDefault true; + + # A recurring problem with user namespaces is that there are + # still code paths where the kernel's permission checking logic + # fails to account for namespacing, instead permitting a + # namespaced process to act outside the namespace with the + # same privileges as it would have inside it. This is particularly + # bad in the common case of running as root within the namespace. + # + # Setting the number of allowed userns to 0 effectively disables + # the feature at runtime. Attempting to create a user namespace + # with unshare will then fail with "no space left on device". + boot.kernel.sysctl."user.max_user_namespaces" = mkDefault 0; } |