Add a comment about `kernel.unprivileged_userns_clone` sysctl in Debian
authorAlexander Popov <alex.popov@linux.com>
Sat, 27 May 2023 07:05:10 +0000 (10:05 +0300)
committerAlexander Popov <alex.popov@linux.com>
Sat, 27 May 2023 07:05:10 +0000 (10:05 +0300)
kconfig_hardened_check/checks.py

index cda3df86a50a1bd8ccae98d34c95b95b1d12d410..8e52fd8fc27e98cbaa0af8c4c92ecd35b0408a9f 100644 (file)
@@ -16,7 +16,7 @@ This module contains knowledge for checks.
 #    kernel.perf_event_paranoid=2 (or 3 with a custom patch, see https://lwn.net/Articles/696216/)
 #    kernel.kexec_load_disabled=1
 #    kernel.yama.ptrace_scope=3
-#    user.max_user_namespaces=0
+#    user.max_user_namespaces=0 (for Debian, also see kernel.unprivileged_userns_clone)
 #    what about bpf_jit_enable?
 #    kernel.unprivileged_bpf_disabled=1
 #    net.core.bpf_jit_harden=2