diff options
| author | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukasz.kasprzak@pm.me> | 2026-04-14 22:32:43 +0200 |
| commit | 83f7fe4b8402bab171d110703a1b1115efbc9b28 (patch) | |
| tree | 19110702c7d740f6bd8ee4f5d2ebcb97442be237 /straper/db/public/apparmor/apparmor.d/unprivileged_userns | |
| parent | 51d43498b07dc97d795947964534f0903cd05db5 (diff) | |
| download | bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.tar.gz bin-83f7fe4b8402bab171d110703a1b1115efbc9b28.zip | |
cleaned up many scrits and deleted some that were of no use; renamed a lot
Diffstat (limited to 'straper/db/public/apparmor/apparmor.d/unprivileged_userns')
| -rw-r--r-- | straper/db/public/apparmor/apparmor.d/unprivileged_userns | 27 |
1 files changed, 0 insertions, 27 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/unprivileged_userns b/straper/db/public/apparmor/apparmor.d/unprivileged_userns deleted file mode 100644 index bac3f26..0000000 --- a/straper/db/public/apparmor/apparmor.d/unprivileged_userns +++ /dev/null @@ -1,27 +0,0 @@ -# Special profile transitioned to by unconfined when creating an unprivileged -# user namespace. -# -abi <abi/4.0>, -include <tunables/global> - -profile unprivileged_userns flags=(complain) { - audit deny capability, - audit deny change_profile, - - # allow block to be replaced by allow when x dominance test is fixed - #allow all, - allow network, - allow signal, - allow dbus, - allow file rwlkm /**, - allow unix, - allow mqueue, - allow ptrace, - allow userns, - - # stack children to strip capabilities - allow pix /** -> &unprivileged_userns , - - # Site-specific additions and overrides. See local/README for details. - include if exists <local/unprivileged_userns> -} |
