Conversation

Notices

1. Embed this notice
   Rich Felker (dalias@hachyderm.io)'s status on Friday, 08-May-2026 09:22:33 JST Rich Felker

   in reply to

   • Jan Schaumann

   @jschauma And this also prevents all sandboxing without suid helpers.

   • Embed this notice
     Jan Schaumann (jschauma@mstdn.social)'s status on Friday, 08-May-2026 09:22:35 JST Jan Schaumann

     The rxrpc module is likely easier for you to block, but if you can't blocklist the ESP kernel modules, note that that exploit path requires the ability to call `unshare(CLONE_NEWUSER | CLONE_NEWNET)`.

     That is

     ```
     sysctl -w kernel.unprivileged_userns_clone=1
     ```

     prevents the ESP exploit.

     (That also prevents that other silly variant.)

     #DirtyFrag