Details
http://man7.org/linux/man-pages/man7/user_namespaces.7.html
2.https://docs.docker.com/engine/reference/commandline/daemon/
3.http://events.linuxfoundation.org/sites/events/files/slides/User%20Namespaces%20-%20ContainerCon%202015%20-%2016-9-final_0.pdf
4.https://github.com/docker/docker/issues/21050
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Please consult Docker documentation for various ways in which this can be configured depending upon your requirements. Your steps might also vary based on platform – For example, on Red Hat, sub-UIDs and sub-GIDs mapping creation does not work automatically. You might have to create your own mapping.
However, the high-level steps are as below-
Step 1- Ensure that the files/etc/subuidand /etc/subgid exist.
touch /etc/subuid /etc/subgid
Step 2- Start the docker daemon with –userns-remap flag
docker daemon –userns-remap=default &
Impact-
User namespace remapping makes quite a few Docker features incompatible and also currently breaks a few functionalities. Check out the Docker documentation and referenced links for details.
Default Value-
By default, user namespace is not remapped.
Supportive Information
The following resource is also helpful.
This control applies to the following type of system Unix.