Ensure that sandboxed code cannot create new user namespaces

User namespaces are a huge attack surface, so disallow creating new ones.
golemfactory · Nov 15, 2023 · 6e19baf · 6e19baf
1 parent 9189472
commit 6e19baf
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/runtime/init-container/src/init.c b/runtime/init-container/src/init.c
@@ -2096,6 +2096,7 @@ int main(int argc, char **argv) {
     block_signals();
     if (do_sandbox) {
         write_sys("/proc/sys/net/ipv4/ip_unprivileged_port_start", 0);
+        write_sys("/proc/sys/user/max_user_namespaces", 1);
         get_namespace_fd();
     }
     setup_sigfd();