Add note about user namespaces to linux doc

[diracdeltas]

needed for #1986

mostly ported over from
https://github.com/brave/browser-laptop/blob/master/docs/linuxInstall.md

Submitter Checklist:

• Submitted a ticket for my issue if one did not already exist.
• Used Github auto-closing keywords in the commit message.
• Added/updated tests for this change (for new code or code which already has tests).
• Verified that these changes build without errors on
  • Windows
  • macOS
  • Linux
• Verified that these changes pass automated tests (npm test brave_unit_tests && npm test brave_browser_tests) on
  • Windows
  • macOS
  • Linux
• Ran git rebase master (if needed).
• Ran git rebase -i to squash commits (if needed).
• Tagged reviewers and labelled the pull request as needed.
• Requested a security/privacy review as needed.

Test Plan:

Reviewer Checklist:

• New files have MPL-2.0 license header.
• Request a security/privacy review as needed.
• Adequate test coverage exists to prevent regressions.

[mbacchi]

Looks great!

[jacobc-eth]

I've posted in a related issue, but I wanted to repost here:

I'm concerned about the way in which this Issue was closed... User name spaces are explicitly disabled in many Linux distros, because they increase the risk for local kernel escalation. Again, see my post from the Arch Linux docs:

Unprivileged usage is disabled by default unless the kernel.unprivileged_userns_clone sysctl 1 is set to 1 , since it greatly increases the attack surface for local privilege escalation.

https://wiki.archlinux.org/index.php/security

Simply telling people to lower the security of their OS seems irresponsible and concerning. Is there no other real solution in the works?

[jacobc-eth]

Also, the link in the commit isn't even the right instructions for people on many distros. For example, on Arch or Manjaro, the command would be:

sudo sysctl kernel.unprivileged_userns_clone=1
echo kernel.unprivileged_userns_clone = 1 | sudo tee /etc/sysctl.d/00-local-userns.conf

But again, this is reducing the security of the user's OS. We need a real sandboxing solution.

[jacobc-eth]

@bbondy Would you mind taking a look at this? I know you've been focused on security things the past few days.

[bbondy]

Thanks @jacobcantele, would you mind posting an issue on this repo with the above. I searched to see if there was one already but I didn't see one.

[jacobc-eth]

Yes, you got it.

[jacobc-eth]

Thanks @jacobcantele, would you mind posting an issue on this repo with the above. I searched to see if there was one already but I didn't see one.

@bbondy

It looks this issue already exists and should be re-opened: #1899