aboutsummaryrefslogtreecommitdiff
path: root/straper/db/public/apparmor/apparmor.d/unprivileged_userns
diff options
context:
space:
mode:
Diffstat (limited to 'straper/db/public/apparmor/apparmor.d/unprivileged_userns')
-rw-r--r--straper/db/public/apparmor/apparmor.d/unprivileged_userns27
1 files changed, 0 insertions, 27 deletions
diff --git a/straper/db/public/apparmor/apparmor.d/unprivileged_userns b/straper/db/public/apparmor/apparmor.d/unprivileged_userns
deleted file mode 100644
index bac3f26..0000000
--- a/straper/db/public/apparmor/apparmor.d/unprivileged_userns
+++ /dev/null
@@ -1,27 +0,0 @@
-# Special profile transitioned to by unconfined when creating an unprivileged
-# user namespace.
-#
-abi <abi/4.0>,
-include <tunables/global>
-
-profile unprivileged_userns flags=(complain) {
- audit deny capability,
- audit deny change_profile,
-
- # allow block to be replaced by allow when x dominance test is fixed
- #allow all,
- allow network,
- allow signal,
- allow dbus,
- allow file rwlkm /**,
- allow unix,
- allow mqueue,
- allow ptrace,
- allow userns,
-
- # stack children to strip capabilities
- allow pix /** -> &unprivileged_userns ,
-
- # Site-specific additions and overrides. See local/README for details.
- include if exists <local/unprivileged_userns>
-}