daemon.start: disable Apparmor unpriv unconfined mediation

Signed-off-by: Simon Deziel <[email protected]>
canonical · Oct 9, 2023 · d7c436d · d7c436d
1 parent 90a82a8
commit d7c436d
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/snapcraft/commands/daemon.start b/snapcraft/commands/daemon.start
@@ -429,6 +429,13 @@ if [ "$(stat -c '%u' /proc)" = 0 ]; then
             echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns || true
         fi
     fi
+
+    if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined ]; then
+        if [ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined)" = "1" ]; then
+            echo "==> Disabling Apparmor unprivileged unconfined mediation"
+            echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined || true
+        fi
+    fi
 fi
 
 # Setup CRIU