Merge pull request #181 from simondeziel/apparmor_restrict_unprivileg…

…ed_unconfined Disable Apparmor unprivileged unconfined mediation
canonical · Oct 6, 2023 · 62568e7 · 62568e7
2 parents cf788c8 + 504b745
commit 62568e7
Show file tree

Hide file tree

Showing 3 changed files with 13 additions and 4 deletions.
diff --git a/snapcraft/commands/daemon.start b/snapcraft/commands/daemon.start
@@ -418,17 +418,24 @@ if [ "$(stat -c '%u' /proc)" = 0 ]; then
         fi
     fi
 
+    if [ -e /proc/sys/kernel/unprivileged_userns_clone ]; then
+        if [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" = "0" ]; then
+            echo "==> Enabling unprivileged containers kernel support"
+            echo 1 > /proc/sys/kernel/unprivileged_userns_clone || true
+        fi
+    fi
+
     if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
         if [ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns)" = "1" ]; then
             echo "==> Disabling Apparmor unprivileged userns mediation"
             echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns || true
         fi
     fi
 
-    if [ -e /proc/sys/kernel/unprivileged_userns_clone ]; then
-        if [ "$(cat /proc/sys/kernel/unprivileged_userns_clone)" = "0" ]; then
-            echo "==> Enabling unprivileged containers kernel support"
-            echo 1 > /proc/sys/kernel/unprivileged_userns_clone || true
+    if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined ]; then
+        if [ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined)" = "1" ]; then
+            echo "==> Disabling Apparmor unprivileged unconfined mediation"
+            echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined || true
         fi
     fi
 fi

diff --git a/snapcraft/wrappers/editor b/snapcraft/wrappers/editor
@@ -18,6 +18,7 @@ run_cmd() {
 USERNS=1
 [ -e /proc/sys/kernel/unprivileged_userns_clone ] && grep -qxF 0 /proc/sys/kernel/unprivileged_userns_clone && USERNS=0
 [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ] && grep -qxF 1 /proc/sys/kernel/apparmor_restrict_unprivileged_userns && USERNS=0
+[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined ] && grep -qxF 1 /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined && USERNS=0
 
 find_and_spawn() {
     for path in / /usr/ /usr/local/; do

diff --git a/snapcraft/wrappers/remote-viewer b/snapcraft/wrappers/remote-viewer
@@ -17,6 +17,7 @@ run_cmd() {
 USERNS=1
 [ -e /proc/sys/kernel/unprivileged_userns_clone ] && grep -qxF 0 /proc/sys/kernel/unprivileged_userns_clone && USERNS=0
 [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ] && grep -qxF 1 /proc/sys/kernel/apparmor_restrict_unprivileged_userns && USERNS=0
+[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined ] && grep -qxF 1 /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined && USERNS=0
 
 find_and_spawn() {
     for path in / /usr/ /usr/local/; do