[$] User namespaces + file capabilities = trouble

Date:
Thu, 05 Nov 2026 14:33:59 +0000

Description:
User namespaces are a key part of the
kernel's toolkit for assembling containers; processes within a user
namespace can appear to have full root access to the system while gaining
no extra privileges in the wider system. At least, that is the intent. In practice, keeping privilege contained within a user namespace has often
turned out to be difficult. As an example, consider this
small patch series from Josef Bacik, which is intended to address some situations where a process within a user namespace can elevate the
privileges of processes outside of it.

======================================================================
Link to news story:
https://lwn.net/Articles/1103429/


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet UK HUB @ hub.uk.erb.pw (1337:1/100)