| Summary: |
Network isolation fails with recent appamor (as seen in Ubuntu 24.04 onwards) |
| Product: |
[Build System, Metadata & Runtime] BitBake
|
Reporter: |
Ross Burton <ross.burton> |
| Component: |
bitbake | Assignee: |
Ross Burton <ross.burton> |
| Status: |
RESOLVED
FIXED
|
QA Contact: |
|
| Severity: |
normal
|
|
|
| Priority: |
High
|
CC: |
poky.bs.watcher, poky.watcher, richard.purdie
|
| Version: |
5.1 | |
|
| Target Milestone: |
5.1 M4 | |
|
| Hardware: |
x86 | |
|
| OS: |
Multiple | |
|
| Whiteboard: |
|
|
OS type for building Yocto:
|
---
|
Type of Regression:
|
---
|
|---|
|
Verified:
|
|
Documentation change:
|
Yes (doc changes required)
|
|---|
Recent releases of apparmor (at least, as packaged by ubuntu) have an "unprivileged_userns" profile which blocks applications from creating new user namespaces. This means bitbake will fail to enable the network isolation with an error like this: Traceback (most recent call last): File "bitbake/bin/bitbake-worker", line 268, in child bb.utils.disable_network(uid, gid) File "/bitbake/lib/bb/utils.py", line 1653, in disable_network with open("/proc/self/uid_map", "w") as f: PermissionError: [Errno 1] Operation not permitted For system binaries it possible to write profiles to allow the specific binaries to create user namespaces, but as bitbake is fetched by the user there's no way of specifying a path that upstream would accept. https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2056555 is the upstream apparmor bug tracking this issue, but we will not be getting a profile to allow any binary called 'bitbake-worker' to create a user namespace as that would compromise the security improvements intended by this change. https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890#unprivileged-user-namespace-restrictions talks about this feature and has several approaches to resolve it.