$ the-wire · showcase
Kernel v7.2.2-arch1 adds sysctl to disable unprivileged CLONE_NEWUSER
By RepoJournal · Filed · About Arch Linux
Arch Linux released kernel v7.2.2-arch1 with a new sysctl that can disable unprivileged user namespaces, and archinstall improved its disk and config handling.
The new kernel release [1] adds a sysctl to allow disabling unprivileged CLONE_NEWUSER, giving admins a toggle to restrict an attack surface that many consider risky. archinstall [2] changed the default EFI mount fmask from 0077 to 0177, aligning with systemd and fixing bootctl requirements for non-executable file bit permissions; this is a behavior change for new installs. A UX fix [3] gates the credential encryption prompt in save_config behind 'user_creds' and 'all' save options, so it no longer appears when only writing user_configuration.json. Type checking for archinstall [4] gets a stub file for pyparted, quieting mypy complaints about missing library stubs. Haskell packages in extra-staging were updated: hackage-security to 0.6.3.2-68 [5], hslua-typing to 0.2.0-2 [6], streams to 3.3.3-172 [7], ral to 0.2.2-102 [8], and chimera to 0.4.1.0-191 [9], all routine for staging.
Action items
- → Update to kernel v7.2.2-arch1 if you want the new sysctl for disabling unprivileged CLONE_NEWUSER archlinux/linux [monitor]
- → Review EFI mount fmask change if you depend on bootctl behavior in archinstall installs archlinux/archinstall [plan]
References
- [1] Arch Linux kernel v7.2.2-arch1 ↗ archlinux/linux
- [2] fix(disk): use fmask=0177 for EFI partition mount options (#4715) ↗ archlinux/archinstall
- [3] fix: only prompt for credentials encryption when creds will be saved ↗ archlinux/archinstall
- [4] Add stub file for pyparted ↗ archlinux/archinstall
- [5] update haskell-hackage-security to 0.6.3.2-68 in extra-staging-x86_64 ↗ archlinux/state
- [6] update haskell-hslua-typing to 0.2.0-2 in extra-staging-x86_64 ↗ archlinux/state
- [7] update haskell-streams to 3.3.3-172 in extra-staging-x86_64 ↗ archlinux/state
- [8] update haskell-ral to 0.2.2-102 in extra-staging-x86_64 ↗ archlinux/state
- [9] update haskell-chimera to 0.4.1.0-191 in extra-staging-x86_64 ↗ archlinux/state