Apparmor unprivileged restrictions disable

[simondeziel]

At the distro level, Ubuntu 24.04 LTS should ship with additional restrictions preventing unconfined processes from creating userns by default.

The long term goal is for LXD to play nice with those additional restrictions but since a lots of moving parts are involved (kernel, kernel config, apparmor parser, core24 snap, snapd and LXD itself) and not fully ready yet, we decided on disabling those restrictions globally by default in the short term. This decision also took into consideration that LXD needs to work across many distros and versions (Debian w/ Apparmor, old Ubuntu version, old Ubuntu version with HWE kernel, etc).

This PR thus introduce a new snap config key (apparmor.unprivileged-restrictions-disable) that in its default value (true) causes LXD to set kernel.apparmor_restrict_unprivileged_userns=0 and kernel.apparmor_restrict_unprivileged_unconfined=0 thus disabling the new restrictions.

For additional information on those new restrictions, see https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces and https://discourse.ubuntu.com/t/spec-unprivileged-user-namespace-restrictions-via-apparmor-in-ubuntu-23-10/37626.

This PR reintroduced bits of #175.

[github-advanced-security]

This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation.

[simondeziel]

This was tested in a local 24.04 VM like this:

$ lxc launch ubuntu-daily:24.04 nv1 --vm
$ lxc shell nv1
root@nv1:~# snap install lxd   # getting the assertion in place
lxd 5.20-f3dd836 from Canonical✓ installed
root@nv1:~# snap install --dangerous /dev/shm/lxd_0+git.170c8352_amd64.snap 
lxd 0+git.170c8352 installed
root@nv1:~# snap alias lxd.lxc lxc
Added:
  - lxd.lxc as lxc
root@nv1:~# cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns
1
root@nv1:~# cat /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined
0

So the keys have their default values before starting LXD's daemon.

root@nv1:~# systemctl start snap.lxd.daemon.service
root@nv1:~# cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns
0
root@nv1:~# cat /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined
0

So LXD noticed that apparmor_restrict_unprivileged_userns needed to be disabled which it did as we can also confirm in the logs:

root@nv1:~# journalctl -u snap.lxd.daemon.service --grep apparmor
Feb 13 21:47:24 nv1 lxd.daemon[2325]: ==> Disabling Apparmor unprivileged userns mediation

And LXD behaves fine:

root@nv1:~# lxd init --auto
root@nv1:~# lxc launch ubuntu-minimal-daily:22.04 c1 -c security.nesting=true
root@nv1:~# lxc exec c1 -- hostname
c1
root@nv1:~# lxc exec c1 -- systemctl --failed
  UNIT LOAD ACTIVE SUB DESCRIPTION
0 loaded units listed.
root@nv1:~# 

And now to prevent LXD from disabling the Apparmor restriction:

root@nv1:~# snap set lxd apparmor.unprivileged-restrictions-disable=false
root@nv1:~# snap stop lxd
2024-02-13T21:57:45Z INFO Waiting for "snap.lxd.daemon.unix.socket", "snap.lxd.daemon.service" to stop.
Stopped.
root@nv1:~# cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns
0
root@nv1:~# echo 1 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns
root@nv1:~# cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns
1
root@nv1:~# snap start lxd
Started.
root@nv1:~# cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns
1

[simondeziel]

I forgot to test setting the config key to the non-default value.

Update: snap set rejects keys with _ in their name :/

[simondeziel]

@tomponline this time, setting the (new) key to its non-default value (false) worked and did the right thing.

[tomponline]

@masnax in a separate PR please can you update description of this setting to make it clear its the path to the directory containing the minio and mc commands thanks