Namespace UID/GID Map Modification

Tim Peck@timpeck

•updated May 8, 2026•12•0•1,961

Detects potential user namespace manipulation, a common precursor to kernel namespace exploits like Dirty Frag, by monitoring file modifications to uid_map and gid_map.