Embed Notice

@lanodan @quad
No.
If unprivileged userNS is enabled, *any* user can just:
- clone(CLONE_NEWUSER), getting a fresh userNS in which it has all the capabilities
- unshare(CLONE_NEWNET), getting a new netNS, which belongs to its own userNS

any unprivileged process that does that ends up in a new netNS in which it as CAP_NET_ADMIN.

That netNS isn't used by anything else, so it can't really affect any network traffic going through the system.

But it gets its own copy of iptables it can mess with.