opencontainers / opencontainers/runc
contrib: AppArmor profile (and docs) for kernel.apparmor_restrict_unprivileged_userns
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13.5k
- Forks
- 2.3k
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 30
Description
https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
As such, unprivileged processes will only be able to create user namespaces if they are confined and have the “userns,” rule in their AppArmor profile (or if they have CAP_SYS_ADMIN).
…
This feature will be first available as an opt-in in Ubuntu 23.1.
Probably we should provide an apparmor profile in contrib/
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Ubuntu blog link and inspect the existing contrib/ contents to understand how runc-related profiles are organized. Define the AppArmor profile and accompanying documentation needed for kernel.apparmor_restrict_unprivileged_userns; completion should include both artifacts, with their scope and validation approach made explicit.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- documentation, operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100