Podman: restricting unprivileged user namespaces and other syscalls

First written 2026-08-08; Last updated 2026-08-08

Note	TL;DR Podman — unlike Docker — doesn’t restrict user namespaces inside unprivileged containers by default. This can make local privilege escalation attacks easier as root inside the user namespace increases the attack surface.

To verify this, run podman run -it --rm --user 42 debian:trixie followed by unshare -Urn. This gives root within the new user namespace.

When launching a container with Podman or Docker, the available syscalls are restricted using seccomp(2) to protect the system. The Docker defaults are configured in seccomp/default.json (or vendored in moby/moby). Here, clone with CLONE_NEWUSER and clone3 require CAP_SYS_ADMIN. The Podman defaults are configured in seccomp/seccomp.json, which permit clone and clone3 without any additional checks. Podman also permits a few other syscalls by default, making Docker’s profile stricter. For a longer discussion, see also issue 62 in podman-container-tools/container-libs (some links in that issue no longer work; see the updated ones above).

On a Debian system, Podman’s seccomp defaults are stored in /usr/share/containers/seccomp.json. The patch below (against the file in Debian Trixie) makes the following changes to reduce the attack surface:

Disallow spawning new namespaces in containers by restricting clone and disallowing clone3, unshare, setns
Disallow mount-related syscalls
Disallow access to the kernel keyring
Disallow signal (legacy syscall, doesn’t exist on amd64; Docker disables it)

Only the parts relevant to a rootless Podman setup were adopted from Docker; support for containers with additional capabilities was omitted.

To apply the new seccomp rules, either use podman run with --security-opt seccomp=/path/to/seccomp.json or, for Quadlets, set SeccompProfile=/path/to/seccomp.json.

Patch

Download patch

--- a/seccomp.json
+++ b/seccomp.json
@@ -123,8 +123,6 @@
                                "clock_gettime64",
                                "clock_nanosleep",
                                "clock_nanosleep_time64",
-                               "clone",
-                               "clone3",
                                "close",
                                "close_range",
                                "connect",
@@ -168,11 +166,7 @@
                                "flock",
                                "fork",
                                "fremovexattr",
-                               "fsconfig",
                                "fsetxattr",
-                               "fsmount",
-                               "fsopen",
-                               "fspick",
                                "fstat",
                                "fstat64",
                                "fstatat64",
@@ -234,7 +228,6 @@
                                "ioprio_get",
                                "ioprio_set",
                                "ipc",
-                               "keyctl",
                                "kill",
                                "landlock_add_rule",
                                "landlock_create_ruleset",
@@ -267,9 +260,6 @@
                                "mlockall",
                                "mmap",
                                "mmap2",
-                               "mount",
-                               "mount_setattr",
-                               "move_mount",
                                "mprotect",
                                "mq_getsetattr",
                                "mq_notify",
@@ -292,7 +282,6 @@
                                "nanosleep",
                                "newfstatat",
                                "open",
-                               "open_tree",
                                "openat",
                                "openat2",
                                "pause",
@@ -301,7 +290,6 @@
                                "pidfd_send_signal",
                                "pipe",
                                "pipe2",
-                               "pivot_root",
                                "pkey_alloc",
                                "pkey_free",
                                "pkey_mprotect",
@@ -389,7 +377,6 @@
                                "setgroups",
                                "setgroups32",
                                "setitimer",
-                               "setns",
                                "setpgid",
                                "setpriority",
                                "setregid",
@@ -412,7 +399,6 @@
                                "shmget",
                                "shutdown",
                                "sigaltstack",
-                               "signal",
                                "signalfd",
                                "signalfd4",
                                "sigprocmask",
@@ -453,12 +439,9 @@
                                "truncate64",
                                "ugetrlimit",
                                "umask",
-                               "umount",
-                               "umount2",
                                "uname",
                                "unlink",
                                "unlinkat",
-                               "unshare",
                                "utime",
                                "utimensat",
                                "utimensat_time64",
@@ -709,6 +692,28 @@
                        },
                        "excludes": {}
                },
+               {
+                       "names": [
+                               "clone"
+                       ],
+                       "action": "SCMP_ACT_ALLOW",
+                       "args": [
+                               {
+                                       "index": 0,
+                                       "value": 2114060288,
+                                       "op": "SCMP_CMP_MASKED_EQ"
+                               }
+                       ],
+                       "excludes": {
+                               "caps": [
+                                       "CAP_SYS_ADMIN"
+                               ],
+                               "arches": [
+                                       "s390",
+                                       "s390x"
+                               ]
+                       }
+               },
                {
                        "names": [
                                "fanotify_init",

back

Last updated 2026-08-08