15592 2024-09-10 15:56:05 +0000 Network isolation fails with recent appamor (as seen in Ubuntu 24.04 onwards) 2024-09-19 14:51:50 +0000 1 1 7 Build System, Metadata & Runtime BitBake bitbake 5.1 x86 Multiple RESOLVED FIXED High normal 5.1 M4 1 ross.burton ross.burton poky.bs.watcher poky.watcher richard.purdie --- --- Yes (doc changes required) oldest_to_newest 99630 0 ross.burton 2024-09-10 15:56:05 +0000 Recent releases of apparmor (at least, as packaged by ubuntu) have an "unprivileged_userns" profile which blocks applications from creating new user namespaces. This means bitbake will fail to enable the network isolation with an error like this: Traceback (most recent call last): File "bitbake/bin/bitbake-worker", line 268, in child bb.utils.disable_network(uid, gid) File "/bitbake/lib/bb/utils.py", line 1653, in disable_network with open("/proc/self/uid_map", "w") as f: PermissionError: [Errno 1] Operation not permitted For system binaries it possible to write profiles to allow the specific binaries to create user namespaces, but as bitbake is fetched by the user there's no way of specifying a path that upstream would accept. https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2056555 is the upstream apparmor bug tracking this issue, but we will not be getting a profile to allow any binary called 'bitbake-worker' to create a user namespace as that would compromise the security improvements intended by this change. https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions talks about this feature and has several approaches to resolve it. 99661 1 ross.burton 2024-09-12 17:06:39 +0000 Initial patch on the list, which makes disabling/allowing apparmor mandatory. 99675 2 richard.purdie 2024-09-19 14:51:50 +0000 https://git.yoctoproject.org/poky/commit/?id=7004840f3dc12e76822cee7b48902c08a553a118