Re: Re: Linux: Disabling network namespaces

[John Johansen <john.johansen () canonical com>]

On 4/19/24 12:01, nightmare.yeah27 () aceecat org wrote:
> On Wed, Apr 17, 2024 at 09:52:10AM GMT, Georgia Garcia wrote:
>
> > I just wanted to add that in the Ubuntu Noble Numbat release we are
> > using AppArmor to restrict unprivileged user namespaces.
>
> > Applications that don't have an AppArmor profile will use a default
> > profile which denies the use of capabilities within the user
> > namespace.  Applications that need to use capabilities will have to
> > be confined by a profile. Since we understand that creating an
> > AppArmor profile might not be a trivial task for large programs, we
> > introduced the "unconfined" flag which makes the profile act as if
> > it were unconfined from the perspective of AppArmor, allowing all
> > operations.
>
> > There are more details here:
>
> > https://discourse.ubuntu.com/t/noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions-13
>
> I wonder if this (at least the kernel part of it) is already in the
> latest PopOS rolling updates? I see some nodes in /proc/sys/kernel
> that look very related.

partially. The ability to straight up deny user namespace creation is
in the kernel already. The ability to transition the profile and the
default behavior for unconfined is not. In Ubuntu the behavior for
the unconfined profile is hard coded as there is still some work to be
done around allowing this to be replaced easily in policy (its
possible but has some limitations/costs that were not acceptable).

Once the work to make replacing unconfined easy is done that will be
upstreamed and the hard coded behavior will get dropped.