John Johansen 7abfc1baf7 profiles: fix sbuild to work with the unprivileged_unshare profile ... sbuild is an unconfined profile allowing it to by-pass the unprivlieged user namespace restritction. unconfined profiles us a pix transition which means when the unprivileged_unshare profile is enabled, the binaries in an unconfined profile calls unshare it will transition to the unprivileged_unshare profile. This will break sbuild because it needs capabilities within the user namespace. However we can not just add a x transition rule to unconfined profiles, the transitions won't be respected. Instead we have to make the profile a default allow profile, and add a transition that will override the default pix transition of allow all. We have to add the attached_disconnected and mediated_deleted flags because sbuild is manipulating mounts. Signed-off-by: John Johansen <john.johansen@canonical.com>		2025-02-19 16:05:57 -08:00
..
apparmor/profiles/extras	Remove no-longer-true aa-enforce line from unshare-userns-restrict	2025-02-11 11:56:29 -08:00
apparmor.d	profiles: fix sbuild to work with the unprivileged_unshare profile	2025-02-19 16:05:57 -08:00
Makefile	Check if all profiles and abstractions contain abi/4.0	2024-10-06 12:07:58 +02:00