Update unprivileged_userns_restriction

unprivileged_userns_restriction.md

@@ -1,15 +1,31 @@
 # Introduction
 
+unconfined processes with capability MAC_OVERRIDE will 
+
 # Introspection of kernel 
 
+## proc
+
+## apparmor
+
+userns_create
+
+
 # Audit message
 
-# sysctl
+# controlling unprivileged user namespace restrivtions via sysctl
+
+apparmor_restrict_unprivileged_userns
+
 
 ## Setting at runtime
 
-## Kernel Build kconfig option
 
 ## 
 
 # policy
+
+
+# Kernel Build kconfig option
+
+The Kconfig option```SECURITY_APPARMOR_RESTRICT_USERNS``` allows setting the default value sysctl. If ```N``` apparmor's unprivileged user namespace restrictions will be disabled by default. If ```Y``` apparmor's unprivileged user namespace restrictions will be enabled by default. Setting the sysctl at runtime will override the default Kconfig value.