mediumsystemverified ✓rollback-safe
Disable unprivileged user namespaces
user-namespaces-disabled · RHEL ≥ 8 · 1 impl
Description
The user.max_user_namespaces sysctl should be set to 0 to disable unprivileged user namespaces unless specifically required.
Rationale
User namespaces allow unprivileged users to create privileged contexts which have been used in numerous kernel exploits. Disabling them reduces the attack surface.
Check → Remediate
Checksysctl_value
- key:
- user.max_user_namespaces
- expected:
- 0
Remediatesysctl_set
- key:
- user.max_user_namespaces
- value:
- 0
Framework references
STIG
V-230548V-257816
NIST 800-53
CM-6
Live verification
rhel8:checkrhel9:check
#sysctl#namespaces#kernel#security#stig