mirrors/apparmor
1
0
Fork 0
mirror of https://gitlab.com/apparmor/apparmor.git synced 2025-03-04 08:24:42 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update unprivileged_userns_restriction

John Johansen 2022-10-21 14:31:58 +00:00
parent dcb50ee67b
commit cea63063b5
1 changed files with 12 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
unprivileged_userns_restriction.md

@ -1,6 +1,6 @@
# Introduction
unconfined processes with capability MAC_OVERRIDE will
unconfined processes with capability SYS_ADMIN will
unprivileged_userns_clone
@ -11,15 +11,18 @@ cat /proc/sys/kernel/unprivileged_userns_clone
# Discovering if your kernel supports restrictions on unprivileged user namespaces
Kernel support for restricting unprivileged user namespaces
There are two ways to determine if your Kernel has support for restricting unprivileged user namespaces
## proc
## Looking in /proc
If the file
```
$ sudo cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns
0
/proc/sys/kernel/apparmor_restrict_unprivileged_userns
```
exists your kernel supports restrictions on unprivileged user namespaces
## apparmor
The presence of AppArmor's ability to control user namespaces can also be found by introspecting AppArmor's advertised feature set via the following command
@ -46,6 +49,10 @@ apparmor_restrict_unprivileged_userns
## Setting at runtime
```
$ sudo cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns
0
```
##