From 9f5f3c2f8bc2c3d82678672f3e700c1eb4e52d61 Mon Sep 17 00:00:00 2001 From: Luca Boccassi Date: Sun, 16 Jun 2024 11:16:21 +0100 Subject: [PATCH] mkosi: enable unprivileged user ns for integration tests Ubuntu disables them by default in Noble, ship a sysctl to turn them back on so that tests can use them (cherry picked from commit 4cfcde024f34b3e5f682364d4e0c6185ef07d467) --- .../usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 mkosi.images/system/mkosi.extra/usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf diff --git a/mkosi.images/system/mkosi.extra/usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf b/mkosi.images/system/mkosi.extra/usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf new file mode 100644 index 0000000000..657ac72f8d --- /dev/null +++ b/mkosi.images/system/mkosi.extra/usr/lib/sysctl.d/99-apparmor-unpriv-userns.conf @@ -0,0 +1,4 @@ +# Ubuntu since Noble disables unprivileged user namespaces by default, re-enable them as they are needed +# for integration tests +kernel.apparmor_restrict_unprivileged_unconfined = 0 +kernel.apparmor_restrict_unprivileged_userns = 0