binpash / binpash/try

Add note about AppArmor restricting unprivileged namespaces in Ubuntu 24.04 to README

Open
#198 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
5.5k
Forks
81
Avg merge
1m
Merged PRs (30d)
1

Description

Commit 18a365c addressed this in CI, but it took a couple minutes to find the (arguably insecure) fix myself, so it would be convenient to mention this in the docs. Here’s the original bug report I wrote on this:

Starting in Ubuntu 23.10, [AppArmor](https://discourse.ubuntu.com/t/spec-unprivileged-user-namespace-restrictions-via-apparmor-in-ubuntu-23-10/37626) prevents unprivileged applications without a profile from creating namespaces.

This causes `./configure` to fail with “try needs unshare to work, but could not run unshare.”

The easy solution is to run `sudo sysctl kernel.apparmor_restrict_unprivileged_userns=0` to disable the apparmor restriction. Another solution would be to provide a PPA or a .deb installable that sets up the apparmor profile.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.