New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

contrib: AppArmor profile (and docs) for kernel.apparmor_restrict_unprivileged_userns #4069

Open

AkihiroSuda opened this issue Oct 11, 2023 · 1 comment

Labels

Member

AkihiroSuda commented Oct 11, 2023

https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces

As such, unprivileged processes will only be able to create user namespaces if they are confined and have the “userns,” rule in their AppArmor profile (or if they have CAP_SYS_ADMIN).
…
This feature will be first available as an opt-in in Ubuntu 23.1.

Probably we should provide an apparmor profile in contrib/

AkihiroSuda added the area/apparmor label

Member Author

AkihiroSuda commented Oct 12, 2023

/etc/apparmor.d/usr.sbin.runc from apparmor_4.0.0~alpha2-0ubuntu5_amd64.deb:

abi <abi/4.0>,
include <tunables/global>

/usr/sbin/runc flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.sbin.runc>
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment