we have to enable user namespaces and change setup in sysctl.conf

for CONFIG_USER_NS to work correctly. This is required for the chrome
sandbox to work correctly when potentially using a Zoom-Client.

Author: jens-maus

buildroot-external/kernel/6.12/global.config

@@ -380,3 +380,6 @@ CONFIG_ACPI_APEI_GHES=y
 # enable firmware compression
 CONFIG_FW_LOADER_COMPRESS=y
 CONFIG_FW_LOADER_COMPRESS_ZSTD=y
+
+# enable USER_NS
+CONFIG_USER_NS=y

buildroot-external/rootfs-overlay/etc/sysctl.conf

@@ -10,8 +10,8 @@ kernel.perf_event_paranoid = 3
 # Avoid non-ancestor ptrace access to running processes and their credentials.
 kernel.yama.ptrace_scope = 1
 
-# Disable User Namespaces, as it opens up a large attack surface to unprivileged users.
-user.max_user_namespaces = 0
+# Enable User Namespaces for sanboxing applications like chrome, etc.
+user.max_user_namespaces = 15000
 
 # increase netfilter conntrack maximum hash table size to 256K
 net.netfilter.nf_conntrack_buckets = 65536