grsecurity docs: add note about user namespaces
This commit is contained in:
parent
65ed79a1e8
commit
567640d80c
|
@ -265,6 +265,11 @@
|
|||
<sect1 xml:id="sec-grsec-issues"><title>Issues and work-arounds</title>
|
||||
|
||||
<itemizedlist>
|
||||
<listitem><para>User namespaces require <literal>CAP_SYS_ADMIN</literal>:
|
||||
consequently, unprivileged namespaces are unsupported. Applications that
|
||||
rely on namespaces for sandboxing (e.g., chromium) must use a privileged
|
||||
helper.</para></listitem>
|
||||
|
||||
<listitem><para>Access to EFI runtime services is disabled by default:
|
||||
this plugs a potential code injection attack vector; use
|
||||
<option>security.grsecurity.disableEfiRuntimeServices</option> to override
|
||||
|
|
Loading…
Reference in a new issue