Turn off unprivileged sandboxes (user namespaces)

Why it matters

User namespaces let an ordinary program act as a pretend administrator inside a private space. That is useful for sandboxes, but it also exposes a lot of privileged kernel code to unprivileged users, and many local privilege escalation bugs have started there. Turning them off shrinks that attack surface.

How it works

Sets user.max_user_namespaces to 0, so no new user namespaces can be created by anyone. Programs that already run inside one keep working, but new ones cannot start them.

Who should use it

Only for locked-down machines where you do not run Flatpak, rootless containers or a sandboxed browser. For most desktops this is a trade-off, because those sandboxes protect you too, so removing them can leave you less safe.

What you may notice

Flatpak apps fail with a bwrap error about creating a namespace. Chromium and Firefox may report that their sandbox is unavailable. Rootless containers and many AppImages stop starting.

Check it on your computer

Read the current value:

sysctl user.max_user_namespaces

Apply it by hand

Set it now (until the next restart):

sudo sysctl -w user.max_user_namespaces=0

Keep it after restarts, in a file you own:

sudo tee /etc/sysctl.d/90-kernel-user-namespaces.conf <<'EOF'
user.max_user_namespaces = 0
EOF
sudo sysctl --system

Undo it

Remove the file and restart, or set the old value back with sysctl -w.

Related settings

• Restrict eBPF to administrators
• Limit one program inspecting another

Sources

Linux Hardening Guide (madaidans)

2.2.1

Linux kernel documentation

user.max_user_namespaces