Merge pull request #77 from canonical/latest-candidate

Fork Sync
Hye-Ararat · Oct 9, 2023 · f08a611 · f08a611
2 parents f2b6f80 + da72b8b
commit f08a611
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 2 deletions.
diff --git a/snapcraft/commands/daemon.start b/snapcraft/commands/daemon.start
@@ -424,6 +424,20 @@ if [ "$(stat -c '%u' /proc)" = 0 ]; then
  echo 1 > /proc/sys/kernel/unprivileged_userns_clone || true
  fi
  fi
+
+ if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ]; then
+ if [ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns)" = "1" ]; then
+ echo "==> Disabling Apparmor unprivileged userns mediation"
+ echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns || true
+ fi
+ fi
+
+ if [ -e /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined ]; then
+ if [ "$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined)" = "1" ]; then
+ echo "==> Disabling Apparmor unprivileged unconfined mediation"
+ echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined || true
+ fi
+ fi
 fi
 
 # Setup CRIU

diff --git a/snapcraft/wrappers/editor b/snapcraft/wrappers/editor
@@ -16,7 +16,9 @@ run_cmd() {
 }
 
 USERNS=1
-[ -e /proc/sys/kernel/unprivileged_userns_clone ] && grep -q 0 /proc/sys/kernel/unprivileged_userns_clone && USERNS=0
+[ -e /proc/sys/kernel/unprivileged_userns_clone ] && grep -qxF 0 /proc/sys/kernel/unprivileged_userns_clone && USERNS=0
+[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ] && grep -qxF 1 /proc/sys/kernel/apparmor_restrict_unprivileged_userns && USERNS=0
+[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined ] && grep -qxF 1 /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined && USERNS=0
 
 find_and_spawn() {
  for path in / /usr/ /usr/local/; do

diff --git a/snapcraft/wrappers/remote-viewer b/snapcraft/wrappers/remote-viewer
@@ -15,7 +15,9 @@ run_cmd() {
 }
 
 USERNS=1
-[ -e /proc/sys/kernel/unprivileged_userns_clone ] && grep -q 0 /proc/sys/kernel/unprivileged_userns_clone && USERNS=0
+[ -e /proc/sys/kernel/unprivileged_userns_clone ] && grep -qxF 0 /proc/sys/kernel/unprivileged_userns_clone && USERNS=0
+[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_userns ] && grep -qxF 1 /proc/sys/kernel/apparmor_restrict_unprivileged_userns && USERNS=0
+[ -e /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined ] && grep -qxF 1 /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined && USERNS=0
 
 find_and_spawn() {
  for path in / /usr/ /usr/local/; do