documentation_complete: true


title: 'Disable the use of user namespaces'

description: |-
    {{{ describe_sysctl_option_value(sysctl="user.max_user_namespaces", value="0") }}}
    When containers are deployed on the machine, the value should be set
    to large non-zero value.

rationale: |-
    It is detrimental for operating systems to provide, or install by default, functionality exceeding requirements or system objectives.
    These unnecessary capabilities or services are often overlooked and therefore may remain unsecured.
    They increase the risk to the platform by providing additional attack vectors.
    User namespaces are used primarily for Linux containers. The value 0
    disallows the use of user namespaces.

warnings:
    - general: |-
       This configuration baseline was created to deploy the base operating system for general purpose
       workloads. When the operating system is configured for certain purposes, such as to host Linux Containers,
       it is expected that <tt>user.max_user_namespaces</tt> will be enabled.

severity: medium

identifiers:
    cce@rhcos4: CCE-82503-4
    cce@rhel8: CCE-82211-4
    cce@rhel9: CCE-83956-3
    cce@rhel10: CCE-89527-6

references:
    nist: SC-39,CM-6(a)
    ospp: FMT_SMF_EXT.1
    srg: SRG-OS-000480-GPOS-00227
    stigid@ol8: OL08-00-040284

ocil: |
    Verify that {{{ full_name }}} disables the use of user namespaces with the following commands:

    Note: User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable.

    {{{ ocil_sysctl_option_value(sysctl="user.max_user_namespaces", value="0") }}}

ocil_clause: "the correct value is not returned"

fixtext: |-
    Configure {{{ full_name }}} to disable the use of user namespace.

    Note: User namespaces are used primarily for Linux containers. If containers are in use, this requirement is not applicable.

    {{{ fixtext_sysctl(sysctl="user.max_user_namespaces", value="0") | indent(4) }}}

srg_requirement: '{{{ full_name }}} must disable the use of user namespaces.'

platform: system_with_kernel

template:
    name: sysctl
    vars:
        sysctlvar: user.max_user_namespaces
        sysctlval: '0'
        datatype: int

warnings:
    - functionality: |-
       Remediation of this rule might impair or prevent functionality of certain applications.
       This stands especially for general container usage and for certain desktop applications.
       There is an alternative rule which performs the same check but it intentionally lacks the remediation part.
       If needed, you can use the rule <tt>sysctl_user_max_user_namespaces_no_remediation</tt>.
       In that case, ensure that such use case is properly documented.
