User namespaces (CLONE_NEWUSER), although useful security feature, do increase kernel attack surface. For example, one can gain access to iptables:
$ iptables -S iptables v1.4.21: can't initialize iptables table `filter': Permission denied (you must be root) Perhaps iptables or your kernel needs to be upgraded. $ unshare -rn # iptables -S -P INPUT ACCEPT -P FORWARD ACCEPT -P OUTPUT ACCEPT
Although this network namespace does can't affect usual real network, it can help local root exploits.
In addition user namespaces seem to override PR_SET_NO_NEW_PRIVS, reducing its effectiveness in shrinking the attack surface:
$ ping 127.0.0.1 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.067 ms ^C $ setpriv --no-new-privs bash $ ping 127.0.0.1 ping: icmp open socket: Operation not permitted $ unshare -rn # ifconfig lo up # ping 127.0.0.1 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.053 ms ^C
User namespaces fail in chrooted environments since kernel 3.9. They can also be disabled in kernel config.