Arch Linux

rabidporpoise

Member

Registered: 2026-07-21

Posts: 1

sysctl knobs for user namespaces

Long-time Arch user, but I recently came up with a question that I'm not sure of the answer to. Specifically, I'm trying to compare `user.max_user_namespaces` and `kernel.unprivileged_userns_clone`. I'm not looking to start an argument as to whether user namespaces are a good thing, just how these two sysctl knobs interact. Here's what I think I know (many references to this LWN.net article on the subject):

• The Linux kernel introduces user namespaces in 2013 or so. The original implementation allows unprivileged users to create namespaces, with no way of disabling the functionality

• Also around 2013, Ubuntu puts out a patch introducing the `kernel.unprivileged_userns_clone` knob (basing this off references to "Saucy" in the patch)

• In 2016, a patch is proposed to provide granular control over user namespace access. Eric B, the kernel dev responsible for user namespaces, hates it. A suggestion is made to compromise by providing a means of limiting the number of namespaces

• At some point the proposed compromise is written and merged into the mainline kernel

• Arch Linux has the `user.max_user_namespaces` knob because it is part of mainline upstream. However, the Debian/Ubuntu patch for `kernel.unprivileged_userns_clone` is also integrated as one of the few patches that Arch applies, even in the default `linux` kernel

With that background out of the way, I think the Arch kernels support three states for user namespaces:

1. Unrestricted use of user namespaces for users both unprivileged and otherwise; this is the default of the main `linux` kernel

   user.max_user_namespaces = 63386 # default on my system
   kernel.unprivileged_userns_clone = 1

2. Use of user namespaces is restricted to root and `CAP_SYS_ADMIN` alone; this is the default of the `linux-hardened` kernel

   user.max_user_namespaces = 63386
   kernel.unprivileged_userns_clone = 0

3. User namespace functionality is completely disabled in the kernel; this breaks some systemd units (and probably other things)

   user.max_user_namespaces = 0
   kernel.unprivileged_userns_clone = 0

Is this an accurate understanding? This came about because while fooling around with the wiki article on Security I found that UPower works fine with `linux-hardened`, but setting the (paranoid) setting for `user.max_user_namespaces` recommended by the KSPP group rendered the systemd unit unstartable.

TLDR How do the sysctl knobs `user.max_user_namespaces` and `kernel.unprivileged_userns_clone` compare and interact?

dimich

Member

From: Kharkiv, Ukraine

Registered: 2009-11-03

Posts: 718

Re: sysctl knobs for user namespaces

How do the sysctl knobs `user.max_user_namespaces` and `kernel.unprivileged_userns_clone` compare and interact?

Afaiu from sources, they are orthogonal.
kernel.unprivileged_userns_clone is system-wide and defines whether unprivileged process can create new userns.
user.max_user_namespaces is specific for current user namespace. It is possible to modify user.max_user_namespaces=0 in one userns without affecting other namespaces.
So clone() with CLONE_NEWUSER may fail in either case: user.max_user_namespaces limit is reached in caller's userns, or caller's process is unprivileged and kernel.unprivileged_userns_clone == 0.
(I'm not 100% sure, please correct me if I'm mistaken).