| 1 | #!/bin/sh |
| 2 | # CI-only admission for Ubuntu's restricted unprivileged user namespaces. |
| 3 | # Use the distro profile: bwrap can construct its namespaces, while its |
| 4 | # children enter unpriv_bwrap with capabilities denied. Global policy stays on. |
| 5 | set -eu |
| 6 | |
| 7 | profile=/usr/share/apparmor/extra-profiles/bwrap-userns-restrict |
| 8 | test -r "$profile" |
| 9 | sudo install -m 0644 "$profile" /etc/apparmor.d/bwrap-userns-restrict |
| 10 | sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict |
| 11 | |
| 12 | # Match the product's isolated namespace/no-network setup before compiling. |
| 13 | # A denied setup is a provisioning failure, never a skipped safety test. |
| 14 | env -i /usr/bin/bwrap --unshare-all --die-with-parent \ |
| 15 | --ro-bind / / --dev /dev --proc /proc --tmpfs /tmp -- /usr/bin/true |
| 16 |