daemon.start: disable Apparmor unpriv unconfined mediation

Signed-off-by: Simon Deziel <[email protected]>
canonical · Oct 16, 2023 · 8eef740 · 8eef740
1 parent f909096
commit 8eef740
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/snapcraft/commands/daemon.start b/snapcraft/commands/daemon.start
@@ -431,6 +431,13 @@ if [ "$(stat -c '%u' /proc)" = 0 ]; then
             echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns || true
         fi
     fi
+
+    if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined ]; then
+        if [ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined)" = "1" ]; then
+            echo "==> Disabling Apparmor unprivileged unconfined mediation"
+            echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined || true
+        fi
+    fi
 fi
 
 # Setup CRIU