Lubuntu/livecd-rootfs
3
0
Fork 0
mirror of https://git.launchpad.net/livecd-rootfs synced 2026-04-15 21:41:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'arraybolt3/arraybolt3/apparmor' into ubuntu/master

Browse Source
This commit is contained in:
michael.hudson@canonical.com 2026-04-16 09:15:24 +12:00
commit a68ab81199
No known key found for this signature in database
GPG Key ID: 80E627A0AB757E23
5 changed files with 26 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
live-build/auto/config
View File

@ -1560,7 +1560,8 @@ case $PROJECT:${SUBPROJECT:-} in
ubuntu-cpc:*|ubuntu-server:live|ubuntu:desktop-preinstalled| \
ubuntu-wsl:*|ubuntu-mini-iso:*|ubuntu-test-iso:*|ubuntu:|ubuntu:dangerous|ubuntu-oem:*| \
ubuntustudio:*|edubuntu:*|ubuntu-budgie:*|ubuntucinnamon:*|xubuntu:*| \
ubuntukylin:*|ubuntu-mate:*|ubuntu-core-installer:*|lubuntu:*)
ubuntukylin:*|ubuntu-mate:*|ubuntu-core-installer:*|lubuntu:*|kubuntu:*| \
ubuntu-unity:*)
# Ensure that most things e.g. includes.chroot are copied as is
for entry in ${LIVECD_ROOTFS_ROOT}/live-build/${PROJECT}/*; do
case $entry in

11
live-build/kubuntu/hooks/020-kubuntu-live.chroot_early Normal file
View File

@ -0,0 +1,11 @@
#! /bin/sh
set -eu
cat <<EOF > /etc/sysctl.d/20-apparmor.conf
# AppArmor restrictions of unprivileged user namespaces
# Disables AppArmor user namespace restrictions on the live ISO.
kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1
EOF

13
live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/etc/sysctl.d/20-apparmor.conf
View File

@ -1,16 +1,5 @@
# AppArmor restrictions of unprivileged user namespaces
# Allows to restrict the use of unprivileged user namespaces to applications
# which have an AppArmor profile loaded which specifies the userns
# permission. All other applications (whether confined by AppArmor or not) will
# be denied the use of unprivileged user namespaces.
#
# See
# https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction
# https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_unconfined
#
# If it is desired to disable this restriction, it is preferable to create an
# additional file named /etc/sysctl.d/20-apparmor.conf which will override this
# current file and sets this value to 0 rather than editing this current file
# Disables AppArmor user namespace restrictions on the live ISO.
kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1

11
live-build/ubuntu-unity/hooks/020-ubuntu-unity-live.chroot_early Normal file
View File

@ -0,0 +1,11 @@
#! /bin/sh
set -eu
cat <<EOF > /etc/sysctl.d/20-apparmor.conf
# AppArmor restrictions of unprivileged user namespaces
# Disables AppArmor user namespace restrictions on the live ISO.
kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1
EOF

13
live-build/ubuntu/hooks/020-ubuntu-live.chroot_early
View File

@ -18,18 +18,7 @@ EOF
cat <<EOF > /etc/sysctl.d/20-apparmor.conf
# AppArmor restrictions of unprivileged user namespaces
# Allows to restrict the use of unprivileged user namespaces to applications
# which have an AppArmor profile loaded which specifies the userns
# permission. All other applications (whether confined by AppArmor or not) will
# be denied the use of unprivileged user namespaces.
#
# See
# https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction
# https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_unconfined
#
# If it is desired to disable this restriction, it is preferable to create an
# additional file named /etc/sysctl.d/20-apparmor.conf which will override this
# current file and sets this value to 0 rather than editing this current file
# Disables AppArmor user namespace restrictions on the live ISO.
kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1
EOF