[$] User namespaces + file capabilities = trouble
User namespaces are a key part of the kernel's toolkit for assembling containers; processes within a user namespace can appear to have full root…
Why am I seeing this Ranked on source trust — LWN
It ranks mainly on source trust: LWN is the most reliable outlet we track on this subject, and is the only one on the story so far.
Single-sourced. No second organisation has confirmed it yet.
Link-outLink-out, because only one organisation carries it and no first-party source is on it and the subject could not be identified from the text. Link-out means we point at the publisher and say nothing of our own.
| Factor | Weight | Score | Contribution | Where it came from |
|---|---|---|---|---|
| Corroboration | 0.35 | 0.39 | +0.135 25% | 1 independent org on the story. Tier-3 aggregators never corroborate — they can show something is circulating, never that it is true. |
| Source trustleads | 0.25 | 0.85 | +0.212 39% | LWN is the highest-trust source on this story. Trust is taken from the best source, not averaged. |
| Pickup rate | 0.20 | 0.00 | +0.000 0% | One counted organisation, so there is no spread to measure — nothing has picked this up to set a rate. |
| Freshness | 0.20 | 0.97 | +0.193 36% | Halves every 10 hours from the newest item on the story. This is the only factor that rewards a story for nothing more than being recent. |
Corroboration counts distinct organisations, once each, and only from tiers 1 and 2. Freshness halves every 10 hours, so this ranking is a snapshot and will differ at the next build.
AnsyahF · GPL · Wikimedia Commons · illustrativeA patch series from Josef Bacik addresses privilege escalation vulnerabilities in user namespaces. Processes running inside a user namespace can currently elevate privileges for processes outside the namespace, contradicting the intended isolation model where container processes appear to have root access only within their own namespace without gaining actual system privileges.
User namespaces form a core component of container infrastructure by allowing processes to operate with apparent full root permissions in an isolated context. The kernel's design intends to prevent these containerized processes from affecting the wider system, but maintaining this boundary has proven challenging in practice.
The patch series targets specific scenarios where privilege containment fails. Developers relying on user namespaces for security isolation should evaluate whether these fixes affect their deployments and consider upgrading to close the escalation paths.
What happened
User namespaces are a key part of the kernel's toolkit for assembling containers; processes within a user namespace can appear to have full root access to the system while gaining no extra privileges in the wider system. In practice, keeping privilege contained within a user namespace has often turned out to be difficult. As an example, consider this small patch series from Josef Bacik, which is intended to address some situations where a process within a user namespace can elevate the privileges of processes outside of it.
How this story arrived
Ordered by when each source was first observed, which is what the velocity figure is computed from. Publishers backdate; observed order does not.
- 01 Lwn first seen [$] User namespaces + file capabilities = trouble
Overclock clusters coverage from independent sources and grades it automatically. The figures above are computed, not editorial. This page summarises and links to reporting by the outlets named — follow the links for the original work.