Lubuntu/livecd-rootfs
3
0
Fork 0
mirror of https://git.launchpad.net/livecd-rootfs synced 2026-04-16 22:11:03 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disable AppArmor user namespace restrictions on the live ISOs for Kubuntu and Ubuntu Unity

Browse Source
This commit is contained in:
Aaron Rainbolt 2026-03-27 11:51:58 -04:00
parent 1975bbd52b
commit edec1f4a3f
Signed by untrusted user who does not match committer: arraybolt3
GPG Key ID: 39ADDC9EE23AEB08
5 changed files with 26 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
live-build/auto/config
View File

@ -1567,7 +1567,8 @@ case $PROJECT:${SUBPROJECT:-} in
ubuntu-cpc:*|ubuntu-server:live|ubuntu:desktop-preinstalled| \ ubuntu-cpc:*|ubuntu-server:live|ubuntu:desktop-preinstalled| \
ubuntu-wsl:*|ubuntu-mini-iso:*|ubuntu-test-iso:*|ubuntu:|ubuntu:dangerous|ubuntu-oem:*| \ ubuntu-wsl:*|ubuntu-mini-iso:*|ubuntu-test-iso:*|ubuntu:|ubuntu:dangerous|ubuntu-oem:*| \
ubuntustudio:*|edubuntu:*|ubuntu-budgie:*|ubuntucinnamon:*|xubuntu:*| \ ubuntustudio:*|edubuntu:*|ubuntu-budgie:*|ubuntucinnamon:*|xubuntu:*| \
ubuntukylin:*|ubuntu-mate:*|ubuntu-core-installer:*|lubuntu:*) ubuntukylin:*|ubuntu-mate:*|ubuntu-core-installer:*|lubuntu:*|kubuntu:*| \
ubuntu-unity:*)
# Ensure that most things e.g. includes.chroot are copied as is # Ensure that most things e.g. includes.chroot are copied as is
for entry in ${LIVECD_ROOTFS_ROOT}/live-build/${PROJECT}/*; do for entry in ${LIVECD_ROOTFS_ROOT}/live-build/${PROJECT}/*; do
case $entry in case $entry in

11
live-build/kubuntu/hooks/020-kubuntu-live.chroot_early Normal file
View File

@ -0,0 +1,11 @@
#! /bin/sh
set -eu
cat <<EOF > /etc/sysctl.d/20-apparmor.conf
# AppArmor restrictions of unprivileged user namespaces
# Disables AppArmor user namespace restrictions on the live ISO.
kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1
EOF

13
live-build/ubuntu-server/includes.chroot.ubuntu-server-minimal.ubuntu-server.installer/etc/sysctl.d/20-apparmor.conf
View File

@ -1,16 +1,5 @@
# AppArmor restrictions of unprivileged user namespaces # AppArmor restrictions of unprivileged user namespaces
# Allows to restrict the use of unprivileged user namespaces to applications # Disables AppArmor user namespace restrictions on the live ISO.
# which have an AppArmor profile loaded which specifies the userns
# permission. All other applications (whether confined by AppArmor or not) will
# be denied the use of unprivileged user namespaces.
#
# See
# https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction
# https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_unconfined
#
# If it is desired to disable this restriction, it is preferable to create an
# additional file named /etc/sysctl.d/20-apparmor.conf which will override this
# current file and sets this value to 0 rather than editing this current file
kernel.apparmor_restrict_unprivileged_userns = 0 kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1 kernel.apparmor_restrict_unprivileged_unconfined = 1

11
live-build/ubuntu-unity/hooks/020-ubuntu-unity-live.chroot_early Normal file
View File

@ -0,0 +1,11 @@
#! /bin/sh
set -eu
cat <<EOF > /etc/sysctl.d/20-apparmor.conf
# AppArmor restrictions of unprivileged user namespaces
# Disables AppArmor user namespace restrictions on the live ISO.
kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1
EOF

13
live-build/ubuntu/hooks/020-ubuntu-live.chroot_early
View File

@ -18,18 +18,7 @@ EOF
cat <<EOF > /etc/sysctl.d/20-apparmor.conf cat <<EOF > /etc/sysctl.d/20-apparmor.conf
# AppArmor restrictions of unprivileged user namespaces # AppArmor restrictions of unprivileged user namespaces
# Allows to restrict the use of unprivileged user namespaces to applications # Disables AppArmor user namespace restrictions on the live ISO.
# which have an AppArmor profile loaded which specifies the userns
# permission. All other applications (whether confined by AppArmor or not) will
# be denied the use of unprivileged user namespaces.
#
# See
# https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_userns_restriction
# https://gitlab.com/apparmor/apparmor/-/wikis/unprivileged_unconfined
#
# If it is desired to disable this restriction, it is preferable to create an
# additional file named /etc/sysctl.d/20-apparmor.conf which will override this
# current file and sets this value to 0 rather than editing this current file
kernel.apparmor_restrict_unprivileged_userns = 0 kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1 kernel.apparmor_restrict_unprivileged_unconfined = 1
EOF EOF