[veonik]

Yikes... are other popular distros shipping with unprivileged user namespaces enabled by default?

[marcthe12]

Most, I think Debian has patch to be disabled at runtime via sysctl. The reason is that most containers or sandboxing techniques are root only unless you mix it with user namescapes. So most container or sandbox software use suid(firejail) , root daemon(docker) or user namescapes (podman and flatpak). Looking at the cves, user namespaces is probably the safer option

[galangalalgol]

That is part of enabling rootless containers on rhel or similar.

[waynesonfire]

should have re-written it in rust.

[failsecure]

Yes and this decision haunts distros like Ubuntu over and over again. There's no easy win though.

[touisteur]

Do you need a user namespace? I'd expect a network namespace to be enough. Am I missing something?

Edit: should've read better, this seems to need CLONE_NEWUSER.

[jwilk]

You need CAP_SYS_ADMIN to create a new network namespace.