Kernel patches propose tighter caps for unprivileged user namespaces

Hallgrimur H. Gunnarsson of Google has posted an eight-part Linux kernel series that would stop unprivileged user namespaces from automatically receiving a full capability set inside the new namespace.

Today, an ordinary local user who creates a user namespace is granted CAP_FULL_SET scoped to that namespace. Those privileges still reach deep kernel paths, especially networking configuration and raw sockets via CAP_NET_ADMIN and CAP_NET_RAW, code that long assumed a trusted root caller. That surface has been a recurring source of local privilege-escalation bugs. Many container and sandbox workloads only need UID, mount, PID, or basic network isolation and never exercise the high-risk bits, yet administrators lack a clean way to withhold them short of disabling unprivileged user namespaces entirely.

The series stores a capability bounding set on each user namespace. Child namespaces inherit a monotonically shrinking mask from their parent. For unprivileged creators, that mask is further intersected with a new sysctl, unprivileged_userns_caps_allowed, which defaults to the full set for compatibility. Privileged creators are unaffected by the ceiling. A CLONE_NEWUSER_BSET flag on clone3 lets runtimes voluntarily tighten the mask further. On namespace entry the task’s permitted, effective, and bounding sets are clamped to the namespace mask, and implicit capabilities held by parent-namespace owners over children are likewise bounded.

Because dropping CAP_NET_ADMIN would block userspace from bringing up loopback in a fresh network namespace, the series first adds an opt-in flag that automatically enables loopback at netns creation. An nsfs ioctl, NS_USER_GET_INFO, exposes the enforced ceiling for inspection. Selftests cover the sysctl, nested restriction, parent-owner bounds, clone3 path, and loopback behavior.

The design answers earlier feedback that preferred embedding policy in the user namespace over a sixth per-thread capability set. On the linux-kernel list, Andy Lutomirski questioned whether the scheme is strong enough for the common single-level case and whether the real target is essentially one bit, CAP_NET_ADMIN; Serge Hallyn welcomed the effort while noting he has been considering a different control model. The patches remain under review.