ubuntustudio-bugs team mailing list archive

[Aaron Rainbolt <2046844@xxxxxxxxxxxxxxxxxx>]

The reason I was suggesting a single attribute to enable user namespace
creation is because of the myriad of third-party apps that we probably
*aren't* going to catch here that users use out there that require user
namespace privileges. For instance, there are probably at least some
QtWebEngine-based web browsers that aren't in the archive and that we
will never hear of until someone complains that they're broken. Many
other apps may need these same privileges for whatever reason. It seems
odd to expect users to write custom AppArmor policies for each of these,
and it seems unrealistic to think we're going to be able to simply catch
them as they pop up - SRU updates don't go fast enough for this to be
practical in most instances. Having the ability for an end-user to
simply set an attribute and be done seems like it would still be secure
(you have to have root privileges to set the attribute), and simple
enough for someone to Google and find the fix, or ask in an Ubuntu
support room and be provided a one-line fix.

We can use fine-grained controls all we want *in* Ubuntu. It's the users
who have to extend those controls that I'm thinking about.

I'll test the latest attribute attachment profile you suggested. Thanks!

-- 
You received this bug notification because you are a member of Ubuntu
Studio Bugs, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2046844

Title:
  AppArmor user namespace creation restrictions cause many applications
  to crash with SIGTRAP

Status in apparmor package in Ubuntu:
  Confirmed
Status in digikam package in Ubuntu:
  Confirmed
Status in epiphany-browser package in Ubuntu:
  Confirmed
Status in falkon package in Ubuntu:
  Confirmed
Status in qutebrowser package in Ubuntu:
  Confirmed

Bug description:
  Hi, I run Ubuntu development branch 24.04 and I have a problem with
  Epiphany browser 45.1-1 (Gnome Web): program doesn't launch, and I get
  this error

  $ epiphany
  bwrap: Creating new namespace failed: Permission denied

  ** (epiphany:12085): ERROR **: 14:44:35.023: Failed to fully launch dbus-proxy: Le processus fils s’est terminé avec le code 1
  Trappe pour point d'arrêt et de trace (core dumped)

  $ epiphany
  bwrap: Creating new namespace failed: Permission denied

  ** (epiphany:30878): ERROR **: 22:22:26.926: Failed to fully launch dbus-proxy: Le processus fils s’est terminé avec le code 1
  Trappe pour point d'arrêt et de trace (core dumped)

  Thanks for your help!

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2046844/+subscriptions