Anatomy of a user namespaces vulnerability

It is enabled in Fedora 19 by default and I am not sure there is a list of options documented that can be enabled in general. If they were, they probably would be there by default anyway.

> # cat /proc/sys/fs/protected_hardlinks
> 0
>
> Where to enable this option permanently?

Assuming fedora has the common sysctrl initscript/unitfile, along with the associated /etc/sysctrl.d/* and/or /etc/syctrl.conf, you'd set it there (omitting the /proc/sys bit as that's the normal working dir for this unit/script).

As I follow upstream kernel development reasonably closely on both LWN and independently (running a custom configured Linus git kernel), I saw the feature introduced for kernel 3.7, and added entries to my sysctrl.conf file appropriately (JED are my initials, used to distinguish my own modifications, $>> is the non-root version of the last line of my custom-set $PS1 bash prompt (#>> would indicate root, appearing as green on red so there's no mistaking it):

$>>grep protected /etc/sysctl.conf
# JED: protected sticky/tempdir symlinks/hardlinks (kernel 3.7+)
fs.protected_symlinks = 1
fs.protected_hardlinks = 1

Duncan