Disable the use of user namespaces
Disables unprivileged user namespaces by capping user.max_user_namespaces at 0.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
User namespaces let an unprivileged process gain full root capabilities inside an isolated namespace. While powerful for unprivileged containers, they have repeatedly been a source of local privilege-escalation vulnerabilities, because they expose otherwise root-only kernel code paths to ordinary users. Providing functionality beyond what the system actually needs widens the attack surface. On systems that do not run rootless containers, setting user.max_user_namespaces = 0 disables the feature entirely and removes this class of exploit primitives.
What Pavois checks
Pavois reads the effective kernel value of user.max_user_namespaces, not a config file. The live value merges /etc/sysctl.conf, drop-ins in /etc/sysctl.d/ and /run/sysctl.d/, kernel boot parameters and any runtime sysctl -w (container engines and Podman may raise this at runtime). A clean file can coexist with a kernel that still allows user namespaces; Pavois reports the value actually enforced.
describe kernel_parameter('user.max_user_namespaces') do
its('value') { should cmp 0 }
end
describe command("grep -hsE '^[[:space:]]*user.max_user_namespaces[[:space:]]*=[[:space:]]*0([[:space:]]|$)' /etc/sysctl.conf /etc/sysctl.d/*.conf /run/sysctl.d/*.conf /usr/lib/sysctl.d/*.conf /lib/sysctl.d/*.conf 2>/dev/null") do
its('stdout') { should match(/\S/) }
endHow to verify it is applied
Run sysctl user.max_user_namespaces and confirm the output is user.max_user_namespaces = 0. You can also confirm the feature is blocked by attempting unshare --user --map-root-user true as a non-root user, it should fail.
Inspect & investigate
No dedicated log. Inspect runtime state with sysctl user.max_user_namespaces. Attempts to create user namespaces when disabled fail with EPERM; container/runtime failures referencing clone(CLONE_NEWUSER) or unshare errors in journalctl indicate the restriction is taking effect.
Remediation
Pavois's harden plan uses the sysctl resource to set user.max_user_namespaces = 0, persisting it in a managed drop-in and applying it live. Run pavois harden apply to enforce it; it is re-applied at boot via the persisted entry.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| key | user.max_user_namespaces |
|---|---|
| resource | sysctl |
| value | 0 |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
High operational impact where rootless/unprivileged containers are used: setting this to 0 breaks rootless Podman, unprivileged Docker/runc, systemd-nspawn, sandboxed browsers (Chrome/Firefox sandbox), Flatpak/Snap sandboxes, and any tool relying on unshare --user. Before applying, confirm the host does not run rootless containers or namespace-based sandboxes. On servers that only run privileged workloads it is a strong hardening win and is reversible by resetting the key (no reboot needed).