On Tue, 2020-11-17 at 17:19 +0000, Ben Hutchings wrote: > On Tue, 2020-11-17 at 11:18 -0500, Antoine Beaupré wrote: > [...] > > Could we get a little more hard data about the attack vectors here? I > > totally trust the security team's "gut feeling" on this, but it would be > > great to be able to evaluate more concretely what we're talking about > > here. > > > > Local root privilege escalation, basically? Can we get a sense of what > > those vulerabilities are, say with some example CVEs? > > Yes, local privilege escalation. > > From the advisories I've prepared, I think these are all LPEs that were > mitigated by our current patch: [...] > They seem to have slowed to a trickle at this point. And there are > sadly lots of other LPE bugs that it has no effect on. > > > I'm asking because my main concern with security these days is with the > > web browser. It's this huge gaping hole: every measure we can take to > > sandbox that thing is become more and more critical, so I wonder if the > > our tradeoff's evaluation is well adjusted here, especially considering > > a lot of user_ns consumers are bypassing those restrictions by running > > as root anyways... > > I tend to agree with this. [...]
Since no-one contradicted this, I've gone ahead and changed the default on the master branch. I added a NEWS entry for linux-image meta- packages to let people know how to change it back if they want. Ben. -- Ben Hutchings The two most common things in the universe are hydrogen and stupidity.
signature.asc
Description: This is a digitally signed message part
