[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-03-15 Thread John Johansen
@pitti: yes this intended. At this stage we are essentially enumerating the known users of unprivileged user namespaces. We can ship the profile for you or you are welcome to ship it. In the future this is going to gradually tighten, some of the "unconfined" profiles will be developed into real

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-03-15 Thread John Johansen
It solves several problems, but not all. With regard to unprivileged user namespace mediation it should fix - mscode - nautilis - devhelp - element-desktop - piphany - evolution - keybase - opam the element-desktop is still known to have some issues, which are on the snapd side. It

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-03-15 Thread corrado venturini
apparmor 4.0.0~beta2-0ubuntu3 installed today from proposed solves problem of bug https://bugs.launchpad.net/ubuntu/+source/nautilus/+bug/2047256, does it solve other problems too? Thanks -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-03-11 Thread Martin Pitt
Just to make sure that we really talk about the same thing: This bug sounds like it is *intended* that unshare --user --map-root-user /bin/bash -c whoami (as unpriv user) now fails in current Ubuntu 24.04 noble. That still worked in released 23.10. I am starting to test Cockpit on the

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-01-11 Thread John Johansen
We will get this updated with requested information soon. We are currently working on a revision that provides more flexibility and will support some cases that break today. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2024-01-02 Thread Dimitri John Ledkov
Can you please explain how all of this is handled during dist-upgrades? Have all the packages with affected profiles have versioned depends added? Is the featured _not_ turned on during dist-upgrade from jammy hwe to noble, but only after reboot? (as the kernel is compatible, yet during upgrade

[Touch-packages] [Bug 2046477] Re: Enable unprivileged user namespace restrictions by default

2023-12-15 Thread Launchpad Bug Tracker
This bug was fixed in the package apparmor - 4.0.0~alpha2-0ubuntu7 --- apparmor (4.0.0~alpha2-0ubuntu7) noble; urgency=medium [Alex Murray] * Enable user namespace restrictions by default (LP: #2046477) - d/p/u/userns-runtime-disable.patch: add logic to disable user