Control: retitle 823535 requires manual setup to get required capabilities On Thu, 05 May 2016 at 21:17:35 +0200, antistress wrote: > No permissions to creating new namespace, likely because the kernel does not > allow non-privileged user namespaces. On e.g. debian this can be enabled > with 'sysctl kernel.unprivileged_userns_clone=1'." > > Then I had to manually key "sysctl kernel.unprivileged_userns_clone=1"
See xdg-app's README.Debian for other possible solutions to getting the required privileges. I should probably patch this message to point users to the README.Debian instead of giving a specific command. > I don't think that user should be bother with that. No, they shouldn't, but none of the possible solutions is unambiguously correct: they all lead to additional security exposure. This is one of the reasons why xdg-app is only available in the experimental suite at the moment. If you are not able to make informed decisions about the security implications of code that you run as root, I would recommend not using packages from experimental. xdg-app would be in unstable if I thought it was ready; right now, it isn't. I'm hoping that bubblewrap, which was recently spun out from xdg-app (<https://blogs.gnome.org/alexl/2016/04/29/using-bubblewrap-in-xdg-app/>), will improve on this by being a self-contained and easy-to-audit version of the part of xdg-app that requires privileges (and in fact I was just about to file the ITP for it). (bubblewrap is very similar to the solution involving making /usr/bin/xdg-app-helper setuid root.) S
