3 ms·

So, entirely, AppArmor profiles for shipped executables allow escape from privileged environments... Without that additional AppArmor 'blessing', wouldn't the

• bri3d 2y ago
  No; note the last sentence in the article: "a bypass is not even needed on most Linux distributions, because they allow unprivileged users to obtain full capabilities inside namespaces by default (and therefore to exploit CAP_SYS_ADMIN kernel vulnerabilities for example), without any restriction at all." From the kernel standpoint, without a rules engine (AppArmor, seccomp, SELinux), unprivileged user namespaces are an all-or-nothing thing (unprivileged_userns_clone), so distributions have to rely on complex and leaky rules engines to try to allow namespace segmentation without letting users touch the big, broken kernel too much.