Public bug reported:
Summary
On Kubuntu 26.04 installations, /etc/sysctl.d/20-apparmor.conf from the
live ISO ends up on the installed system. It sets
kernel.apparmor_restrict_unprivileged_userns = 0, so installed systems
run without Ubuntu’s AppArmor restriction of unprivileged user
namespaces, although all AppArmor profiles are loaded normally there.
The file’s own comment states it is meant for the live ISO only:
# AppArmor restrictions of unprivileged user namespaces
# Disables AppArmor user namespace restrictions on the live ISO.
kernel.apparmor_restrict_unprivileged_userns = 0
kernel.apparmor_restrict_unprivileged_unconfined = 1
Affected images (verified)
Kubuntu 26.04 “Resolute Raccoon” – Release amd64 (20260423), installed system
Kubuntu 26.04.1 desktop amd64 ISO (checked the image contents)
Steps to reproduce
Install Kubuntu 26.04 from the release ISO.
On the installed system:
$ sysctl kernel.apparmor_restrict_unprivileged_userns
kernel.apparmor_restrict_unprivileged_userns = 0
$ dpkg -S /etc/sysctl.d/20-apparmor.conf
dpkg-query: no path found matching pattern /etc/sysctl.d/20-apparmor.conf
$ ls -l --time-style=long-iso /etc/sysctl.d/20-apparmor.conf
-rw-r--r-- 1 root root 224 2026-04-23 02:43 /etc/sysctl.d/20-apparmor.conf
Expected: kernel.apparmor_restrict_unprivileged_userns = 1 on installed
systems, as set by /usr/lib/sysctl.d/10-apparmor.conf.
Actual: 0, set by an unowned file whose timestamp matches the ISO build
date, not the installation date.
Analysis
The file is created by live-build/kubuntu/hooks/020-kubuntu-live.chroot_early
in livecd-rootfs (commit “Disable AppArmor user namespace restrictions on the
live ISOs for Kubuntu and Ubuntu Unity”, merged from arraybolt3/apparmor
shortly before the 26.04 release).
A chroot_early hook writes into the root filesystem. Kubuntu’s ISO has a single
casper/filesystem.squashfs and no live-only layer:
$ ls /mnt/iso/casper/
filesystem.squashfs initrd vmlinuz
$ unsquashfs -l /mnt/iso/casper/filesystem.squashfs | grep 20-apparmor
squashfs-root/etc/sysctl.d/20-apparmor.conf
Calamares installs via unpackfs from that image. None of its modules removes
the file: grep -r -i -E 'sysctl|apparmor' over /etc/calamares in the 26.04.1
image returns nothing, and the packages module cannot remove it because the
file belongs to no package.
The reason for the live setting is valid: in the live session, apparmor.service
is skipped (ConditionPathExists=!/rofs/etc/apparmor.d), so profiles granting
userns are not loaded (cf. LP: #2065088). On an installed system this does not
apply; all profiles are loaded, so the restriction works as intended.
Ubuntu’s own implementation (LP: #2122675, “Disable
apparmor_restrict_unprivileged_userns in the live layers”) places the file in a
live-only layer, so it does not reach installed systems. The Kubuntu variant
lacks that separation.
Impact
All Kubuntu 26.04 installations from the release and 26.04.1 images
silently run without the unprivileged user namespace restriction, one of
Ubuntu’s main kernel hardening measures against local privilege
escalation (e.g. via nftables bugs reachable from user namespaces).
Nothing breaks visibly, so users are unlikely to notice. Ubuntu Unity
may be affected in the same way, since the same commit added the hook
for it.
Suggested fix
Images: remove the file from the target after unpackfs, e.g. a shellprocess
step running rm -f ${ROOT}/etc/sysctl.d/20-apparmor.conf, or create the file
only in the live session (e.g. via a casper boot script) instead of baking it
into the image.
Existing installations: remove the file via a package update (e.g. in a Kubuntu
settings package’s postinst), only if it is unowned and still has exactly this
content, so deliberate admin changes are preserved.
Workaround
sudo rm /etc/sysctl.d/20-apparmor.conf
sudo sysctl --system
After that, sysctl kernel.apparmor_restrict_unprivileged_userns returns
1. Tested here with Chrome, Steam, Flatpak apps and Plasma components:
no regressions; the only AppArmor denials in the journal were pre-
existing fusermount3 messages unrelated to this setting.
References
LP: #2065088 – AppArmor profiles allowing userns not immediately active in
24.04 live image
LP: #2122675 – Disable apparmor_restrict_unprivileged_userns in the live layers
(Ubuntu)
livecd-rootfs commit edec1f4a3f – Kubuntu/Ubuntu Unity live ISO change
** Affects: calamares-settings-ubuntu (Ubuntu)
Importance: Undecided
Status: New
** Affects: livecd-rootfs (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172113
Title:
Kubuntu 26.04: live-ISO /etc/sysctl.d/20-apparmor.conf is copied to
installed systems, disabling AppArmor user namespace restriction
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/calamares-settings-ubuntu/+bug/2172113/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
