mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 00:14:44 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge profiles: fix sbuild to work with the unprivileged_unshare profile

Browse source 
sbuild is an unconfined profile allowing it to bypass the unprivlieged
user namespace restriction.

unconfined profiles use a pix transition which means that when the
unprivileged_unshare profile is enabled, the binaries in an unconfined
profile calling unshare will cause a transition to the unprivileged_unshare
profile.

This will break sbuild because it needs capabilities within the
user namespace.

However we cannot just add a x transition rule to unconfined profiles, as
the transitions won't be respected. Instead, we have to make the profile
a default allow profile and add a transition that will override
the default pix transition of allow all.

We have to add the attached_disconnected and mediated_deleted flags
because sbuild is manipulating mounts.

Signed-off-by: John Johansen <john.johansen@canonical.com>

MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1555
Approved-by: Ryan Lee <rlee287@yahoo.com>
Merged-by: Georgia Garcia <georgia.garcia@canonical.com>
This commit is contained in:
Georgia Garcia 2025-02-20 17:56:47 +00:00
commit 472181ae75
14 changed files with 84 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
profiles/apparmor.d/sbuild
View file

@ -4,9 +4,14 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild /usr/bin/sbuild flags=(unconfined) {
profile sbuild /usr/bin/sbuild flags=(attach_disconnected mediate_deleted) {
allow all,
userns,
# override default pix
/usr/bin/unshare ix,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/sbuild>
}

7
profiles/apparmor.d/sbuild-abort
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-abort /usr/bin/sbuild-abort flags=(unconfined) {
profile sbuild-abort /usr/bin/sbuild-abort flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-adduser
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-adduser /usr/sbin/sbuild-adduser flags=(unconfined) {
profile sbuild-adduser /usr/sbin/sbuild-adduser flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-apt
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-apt /usr/bin/sbuild-apt flags=(unconfined) {
profile sbuild-apt /usr/bin/sbuild-apt flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-checkpackages
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-checkpackages /usr/bin/sbuild-checkpackages flags=(unconfined) {
profile sbuild-checkpackages /usr/bin/sbuild-checkpackages flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-clean
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-clean /usr/bin/sbuild-clean flags=(unconfined) {
profile sbuild-clean /usr/bin/sbuild-clean flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-createchroot
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-createchroot /usr/bin/sbuild-createchroot flags=(unconfined) {
profile sbuild-createchroot /usr/bin/sbuild-createchroot flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-destroychroot
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-destroychroot /usr/sbin/sbuild-destroychroot flags=(unconfined) {
profile sbuild-destroychroot /usr/sbin/sbuild-destroychroot flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-distupgrade
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-distupgrade /usr/bin/sbuild-distupgrade flags=(unconfined) {
profile sbuild-distupgrade /usr/bin/sbuild-distupgrade flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-hold
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-hold /usr/bin/sbuild-hold flags=(unconfined) {
profile sbuild-hold /usr/bin/sbuild-hold flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-shell
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-shell /usr/bin/sbuild-shell flags=(unconfined) {
profile sbuild-shell /usr/bin/sbuild-shell flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-unhold
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-unhold /usr/bin/sbuild-unhold flags=(unconfined) {
profile sbuild-unhold /usr/bin/sbuild-unhold flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-update
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-update /usr/bin/sbuild-update flags=(unconfined) {
profile sbuild-update /usr/bin/sbuild-update flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.

7
profiles/apparmor.d/sbuild-upgrade
View file

@ -4,7 +4,12 @@
abi <abi/4.0>,
include <tunables/global>
profile sbuild-upgrade /usr/bin/sbuild-upgrade flags=(unconfined) {
profile sbuild-upgrade /usr/bin/sbuild-upgrade flags=(attach_disconnected mediate_deleted) {
allow all,
# override default pix
/usr/bin/unshare ix,
userns,
# Site-specific additions and overrides. See local/README for details.