Ubuntu's default (since 23.10) AppArmor rules break some tests #545

New issue

Open

opened 2024-10-11 15:42:31 +00:00 by vigress8 · 2 comments

vigress8 commented

2024-10-11 15:42:31 +00:00

Member

Describe the bug

Ubuntu now restricts unprivileged user namespaces:
https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces

Which breaks these tests:

 81/161 lix:installcheck / functional-build-remote-input-addressed            FAIL             0.28s   exit status 1
 93/161 lix:installcheck / functional-build-remote-content-addressed-fixed    FAIL             0.35s   exit status 1
 94/161 lix:installcheck / functional-build-remote-content-addressed-floating FAIL             0.38s   exit status 1
 95/161 lix:installcheck / functional-build-remote-trustless-should-pass-0    FAIL             0.35s   exit status 1
 96/161 lix:installcheck / functional-build-remote-trustless-should-pass-1    FAIL             0.36s   exit status 1
 97/161 lix:installcheck / functional-build-remote-trustless-should-pass-2    FAIL             0.38s   exit status 1
 98/161 lix:installcheck / functional-build-remote-trustless-should-pass-3    FAIL             0.38s   exit status 1
100/161 lix:installcheck / functional-build-remote-trustless-should-fail-0    FAIL             0.26s   exit status 100
114/161 lix:installcheck / functional-supplementary-groups                    FAIL             0.14s   exit status 1
115/161 lix:installcheck / functional-linux-sandbox                           FAIL             0.25s   exit status 100
119/161 lix:installcheck / functional-shell                                   FAIL             0.62s   exit status 1
152/161 lix:installcheck / functional-nested-sandboxing                       FAIL             0.28s   exit status 1

Steps To Reproduce

With AppArmor installed, set

sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1

And run the test suite. Observe that the above tests fail with confusing output like

error: executing '/nix/store/c2ph7pk42aa8fa1diy74pkdjyj8qrd1d-busybox': No such file or directory

Expected behavior

The tests should at least error out immediately when this incompatibility is noticed

## Describe the bug Ubuntu now restricts unprivileged user namespaces: https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces Which breaks these tests: ``` 81/161 lix:installcheck / functional-build-remote-input-addressed FAIL 0.28s exit status 1 93/161 lix:installcheck / functional-build-remote-content-addressed-fixed FAIL 0.35s exit status 1 94/161 lix:installcheck / functional-build-remote-content-addressed-floating FAIL 0.38s exit status 1 95/161 lix:installcheck / functional-build-remote-trustless-should-pass-0 FAIL 0.35s exit status 1 96/161 lix:installcheck / functional-build-remote-trustless-should-pass-1 FAIL 0.36s exit status 1 97/161 lix:installcheck / functional-build-remote-trustless-should-pass-2 FAIL 0.38s exit status 1 98/161 lix:installcheck / functional-build-remote-trustless-should-pass-3 FAIL 0.38s exit status 1 100/161 lix:installcheck / functional-build-remote-trustless-should-fail-0 FAIL 0.26s exit status 100 114/161 lix:installcheck / functional-supplementary-groups FAIL 0.14s exit status 1 115/161 lix:installcheck / functional-linux-sandbox FAIL 0.25s exit status 100 119/161 lix:installcheck / functional-shell FAIL 0.62s exit status 1 152/161 lix:installcheck / functional-nested-sandboxing FAIL 0.28s exit status 1 ``` ## Steps To Reproduce With AppArmor installed, set ``` sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=1 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 ``` And run the test suite. Observe that the above tests fail with confusing output like ``` error: executing '/nix/store/c2ph7pk42aa8fa1diy74pkdjyj8qrd1d-busybox': No such file or directory ``` ## Expected behavior The tests should at least error out immediately when this incompatibility is noticed

vigress8 added the

bug

OS/Linux

testing/flakey

labels

2024-10-11 15:42:31 +00:00

jade added the

Area/build-packaging

label

2025-01-30 16:41:24 +00:00

daylinmorgan commented

2025-01-30 17:09:11 +00:00

I hit this issue on the default GHA runners when trying to build lix from main.

Adding the below lines (from the link included above) to my workflow prior to building lix resolved the issue:

sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

I hit this issue on the default GHA runners when trying to build `lix` from main. Adding the below lines (from the link included above) to my workflow prior to building `lix` resolved the issue: ```sh sudo sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 ```

❤️ 1

jade commented

2025-01-30 21:13:31 +00:00

Owner

My memory is that we didn't much want to deal with it because the userspace tools make a bunch of annoying assumptions and require putting stuff in the filesystem. Or at least that's how docker implemented it in their containers. But this might be tolerable or we might be able to do it nicely, or maybe we can bypass the normal userspace tooling completely.

I am wondering if one possible solution to this is to implement deliberate apparmor confinement inside the sandbox to allow it. I did some research on apparmor which I believe is documented here: https://hackmd.io/03UGerewRcy3db44JQoWvw My memory is that we didn't much want to deal with it because the userspace tools make a bunch of annoying assumptions and require putting stuff in the filesystem. Or at least that's how docker implemented it in their containers. But this might be tolerable or we might be able to do it nicely, or maybe we can bypass the normal userspace tooling completely.