From df6988e0fa27a55d658e6d361e8ae5321b53f345 Mon Sep 17 00:00:00 2001 From: Mike Kobit Date: Wed, 8 Jul 2026 23:49:56 -0500 Subject: [PATCH] fix(ci): scope AppArmor userns exemption to bwrap instead of runner-wide Ubuntu 24.04's AppArmor default blocks unprivileged CLONE_NEWUSER for otherwise-unconfined processes, which bwrap needs for rootless sandboxing. The previous fix disabled the restriction runner-wide via kernel.apparmor_restrict_unprivileged_userns=0; this loads a profile scoped to /usr/bin/bwrap that grants it userns creation directly, so every other process on the runner keeps the restriction. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/ci.yml | 25 +++++++++++++++++++------ 1 file changed, 19 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f611ad80..a64a52bf 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -104,13 +104,26 @@ jobs: steps: - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 - - name: Allow unprivileged user namespaces (bwrap) + - name: Load scoped AppArmor profile for bwrap if: runner.os == 'Linux' - # Ubuntu 24.04's AppArmor default blocks unprivileged CLONE_NEWUSER, - # which bwrap requires for rootless sandboxing -- without this, - # sandboxr's bwrap-backed integration tests fail with "setting up - # uid map: Permission denied" / "loopback: Failed RTM_NEWADDR". - run: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 + # Ubuntu 24.04's AppArmor default blocks unprivileged CLONE_NEWUSER + # for otherwise-unconfined processes, which bwrap needs for rootless + # sandboxing -- without this, sandboxr's bwrap-backed integration + # tests fail with "setting up uid map: Permission denied" / + # "loopback: Failed RTM_NEWADDR". A profile scoped to /usr/bin/bwrap + # that grants it `userns,` exempts only that binary; every other + # process on the runner keeps the restriction, unlike flipping + # kernel.apparmor_restrict_unprivileged_userns off runner-wide. + # Ref: https://discourse.ubuntu.com/t/spec-unprivileged-user-namespace-restrictions-via-apparmor-in-ubuntu-23-10/37626 + run: | + cat <<'PROFILE' | sudo tee /etc/apparmor.d/bwrap >/dev/null + abi , + + /usr/bin/bwrap flags=(unconfined) { + allow userns create, + } + PROFILE + sudo apparmor_parser -r /etc/apparmor.d/bwrap - name: Cache chezmoi downloads uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9