User namespaces let processes run with different UIDs and GIDs inside an isolated namespace — a process can appear as root inside the namespace while remaining unprivileged on the host. This isolation benefits containers and sandboxing, but it also expands the attack surface: unprivileged users can create namespaces and then exploit kernel vulnerabilities to escape host-level access controls.
Alibaba Cloud Linux 2 and 3 provide three kernel parameters to reduce this exposure. All three parameters support temporary changes (effective until the next reboot).
| Parameter | What it controls | Kernel version requirement |
|---|---|---|
user.max_user_namespaces | Maximum child namespaces per parent namespace, per level | All supported versions |
kernel.userns_max_level | Maximum nesting depth of user namespaces | AL2 >= 4.19.91-27, AL3 >= 5.10.134-12 |
kernel.unprivileged_userns_clone | Whether users without CAP_SYS_ADMIN can create namespaces | AL2 >= 4.19.91-27, AL3 >= 5.10.134-12 |
user.max_user_namespaces
This parameter caps the number of child namespaces that can be created under each parent namespace at every level of the hierarchy.
Setting this parameter to 0 disables user namespaces entirely.
Query the current value
# /proc interface
cat /proc/sys/user/max_user_namespaces
# sysctl interface
sysctl -n user.max_user_namespacesSet the value
Replace <namespaces> with the maximum number of child namespaces to allow. Set to 0 to disable namespace creation.
# /proc interface
sudo sh -c 'echo <namespaces> > /proc/sys/user/max_user_namespaces'
# sysctl interface
sudo sysctl -w user.max_user_namespaces=<namespaces>kernel.userns_max_level
This parameter limits how deeply user namespaces can be nested.
Version requirements
Alibaba Cloud Linux 2: kernel version 4.19.91-27 and later
Alibaba Cloud Linux 3: kernel version 5.10.134-12 and later
Valid values: 0 to 33
| Value | Behavior |
|---|---|
0 | Disables user namespaces |
1–32 | Limits nesting to the specified number of levels |
33 | Default; matches native kernel behavior |
Query the current value
# /proc interface
cat /proc/sys/kernel/userns_max_level
# sysctl interface
sysctl -n kernel.userns_max_levelSet the value
Replace <levels> with the maximum nesting depth. Set to 0 to disable user namespaces.
# /proc interface
sudo sh -c 'echo <levels> > /proc/sys/kernel/userns_max_level'
# sysctl interface
sudo sysctl -w kernel.userns_max_level=<levels>kernel.unprivileged_userns_clone
This parameter controls whether users without CAP_SYS_ADMIN can create user namespaces. When unprivileged users can create namespaces, a larger population of processes can trigger namespace-related code paths, increasing exposure to privilege escalation vulnerabilities. Restricting namespace creation to privileged users reduces that exposure.
Version requirements
Alibaba Cloud Linux 2: kernel version 4.19.91-27 and later
Alibaba Cloud Linux 3: kernel version 5.10.134-12 and later
Valid values
| Value | Behavior |
|---|---|
1 | Unprivileged users without CAP_SYS_ADMIN can create namespaces (default; matches native kernel behavior) |
0 | Only privileged users with CAP_SYS_ADMIN can create namespaces |
Query the current value
# /proc interface
cat /proc/sys/kernel/unprivileged_userns_clone
# sysctl interface
sysctl -n kernel.unprivileged_userns_cloneRestrict namespace creation to privileged users
# /proc interface
sudo sh -c 'echo 0 > /proc/sys/kernel/unprivileged_userns_clone'
# sysctl interface
sudo sysctl -w kernel.unprivileged_userns_clone=0