edubuntu-bugs team mailing list archive

[John Johansen <2046844@xxxxxxxxxxxxxxxxxx>]

Sorry for the delay on this, we had some bugs to chase down. The
following PPA has an update to how user namespace mediation is being
handled. For the unconfined case there are two options

1. If the unprivileged_userns profile does not exist, unprivileged user
namespace creation is denied as before.

2. If the unprivileged_userns profile exists (ie. is loaded into the
kernel), unprivileged user namespace creation is allowed an will result
in a transition into the unprivileged_userns profile. The
unprivileged_userns profile with then deny all capabilities within the
profile. Execution of applications is allowed within the
unprivileged_userns profile but, they will result in a stack with the
unprivileged_userns profile, that is to say the unprivileged_userns
profile can not be dropped (capabilities can not be gained).

There is still some additional functionality to land that will give
profile authors more control, but what is present here should be enough
to start testing.

https://launchpad.net/~apparmor-dev/+archive/ubuntu/unprivileged-userns

Note: the apparmor_restriction_unprivileged_unconfined needs to be
enabled to test the above user namespace behavior. See
https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction

-- 
You received this bug notification because you are a member of Edubuntu
Bugsquad, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2046844

Title:
  AppArmor user namespace creation restrictions cause many applications
  to crash with SIGTRAP

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/akregator/+bug/2046844/+subscriptions