John Johansen 8e586e5492 Merge profiles: fix non-user-namespace-related sandbox bypass in unshare profile ... The unshare-userns-restrict profile contained a cx transition to transition to a profile that allows most things while denying capabilities: audit allow cx /** -> unpriv, However, this transition does not stack the unshare//unpriv profile against any other profile the target binary might have had. As a result, the lack of stacking resulted in a non-namespace-related sandboxing bypass in which attachments of other profiles that should have confined the target binary do not get applied. Instead, we adopt a stack similar to the one in bwrap-userns-restrict, with the exception that unshare does not use no-new-privs and therefore only needs a two-layer stack instead of a three-layer stack. Signed-off-by: Ryan Lee <ryan.lee@canonical.com> MR: https://gitlab.com/apparmor/apparmor/-/merge_requests/1533 Approved-by: Georgia Garcia <georgia.garcia@canonical.com> Merged-by: John Johansen <john@jjmx.net>		2025-02-12 10:29:33 +00:00
..
apparmor/profiles/extras	Remove no-longer-true aa-enforce line from unshare-userns-restrict	2025-02-11 11:56:29 -08:00
apparmor.d	Merge initial fusermount3 profile	2025-02-12 09:40:28 +00:00
Makefile	Check if all profiles and abstractions contain abi/4.0	2024-10-06 12:07:58 +02:00