Post #1550746
2026-04-22 01:31 UTC
User-namespaces feel like an off-by-one. Having the ability to isolate users within a separate namespace is great. Choosing to have the namespace specifically in the domain of user-identities is fair. Having the kernel treat uid 0 like system namespace's true 'root' user and then having to do rely on additional checks, and sometimes failing to do so, is messy, but understandable for smth that needs maturing.
Replies (1)
-
@cobratbq@mastodon.social 2026-04-22 01:34
It is underatandable that there are paths and edge cases that might run into privilege escalation. I understand that this is a highly complex piece of software. Then not having the possibility to set a capabilities mask for the functionality you certainly do not want/need, is really just a missed opportunity.