Ah thank for noticing that John, it entirely slipped by me - so in that case I don't think this is the appropriate fix - the AppArmor team has worked hard to remove the busybox and other similar profiles that allowed this bypass so I don't think we should do the same for os- prober. Instead, since os-prober is not used by default anymore, and the original use of unshare in os-prober was to make it more robust on desktop systems etc - why not just remove the use of unshare from it? I feel this has a small risk of regression AND it avoids introducing an escape hatch for the unprivileged userns restrictions.
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2099811 Title: Os-prober segmentation fault one message for each partition on same PC To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2099811/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
