Why are user namespaces disabled by default? I’ve read there are possible exploits, like turning root in a namespace to root in the default namespace. Is this still a concern? Does the PureOS team know of a specific problem? The Brave browser requires user namespaces to be enabled.
I have a Librem13v3.
$ uname -a
Linux librem 4.16.0-1-amd64 #1 SMP Debian 4.16.5-1 (2018-04-29) x86_64 GNU/Linux
$ sysctl kernel.unprivileged_userns_clone
kernel.unprivileged_userns_clone = 0
Found an interesting kernel patch and discussion: https://patchwork.kernel.org/patch/10039431/
It’s unlikely this patch has been integrated into a PureOS kernel.
If user-created user namespaces are so insecure, why does Brave require them by default?
There is another post about enabling namespaces for Brave, but there is no commentary on the security implications: Brave Browser in PureOS, won't launch
I don’t know the answer to that, and that is a good question I’d like to know the answer to as well.
I quit using Brave on PureOS as it had some issues that were irritating. Went back to Firefox.
Even with user created namespaces enabled, snap still fails because of apparmor.
[ 2170.957263] audit: type=1400 audit(1527317409.964:89): apparmor=“DENIED” operation=“capable” profile="/usr/lib/snapd/snap-confine" pid=8499 comm=“snap-confine” capability=2 capname=“dac_read_search”
snap and brave in PureOS just aren’t ready yet.