profiles: update bwrap and unshare profiles

Undate the bwrap and unshare profiles to allow stacking against system
application profiles so that bewrap and unshare can not be used to
get around system profile restrictions.

Fixes: https://gitlab.com/apparmor/apparmor/-/issues/382
Signed-off-by: John Johansen <john.johansen@canonical.com>

profiles/apparmor.d/bwrap-userns-restrict

@@ -7,28 +7,62 @@
 # arbitrarily by-pass the user namespace restrictions.
 #
 # Note: the bwrap child is stacked against the bwrap profile due to
-# bwraps used of no-new-privs
+# bwraps use of no-new-privs
+
+# disabled by default as it can break some use cases on a system that
+# doesn't have or has disable user namespace restrictions for unconfined
+# use aa-enforce to enable it
+
+abi <abi/4.0>,
+
+include <tunables/global>
 
 profile bwrap /usr/bin/bwrap flags=(attach_disconnected) {
-    allow capability,
-    allow file rwlkm /{**,},
-    allow network,
-    allow unix,
-    allow ptrace,
-    allow signal,
-    allow mqueue,
-    allow io_uring,
-    allow userns,
-    allow mount,
-    allow umount,
-    allow pivot_root,
-    allow dbus,
-    allow px /** -> bwrap//&unpriv_bwrap,
+  allow capability,
+  # not allow all, to allow for pix stack
+  # sadly we have to allow  m every where to allow children to work under
+  # stacking.
+  allow file rwlkm /{**,},
+  allow network,
+  allow unix,
+  allow ptrace,
+  allow signal,
+  allow mqueue,
+  allow io_uring,
+  allow userns,
+  allow mount,
+  allow umount,
+  allow pivot_root,
+  allow dbus,
+  allow px /** -> bwrap//&unpriv_bwrap,
 
+  # the local include should not be used without understanding the userns
+  # restriction.
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/bwrap-userns-restrict>
 }
 
 profile unpriv_bwrap flags=(attach_disconnected) {
-    allow all,
-    audit deny capability,
-}
+  # not allow all, to allow for pix stack
+  allow file rwlkm /{**,},
+  allow network,
+  allow unix,
+  allow ptrace,
+  allow signal,
+  allow mqueue,
+  allow io_uring,
+  allow userns,
+  allow mount,
+  allow umount,
+  allow pivot_root,
+  allow dbus,
 
+  allow pix /** -> &unpriv_bwrap,
+
+  audit deny capability,
+
+  # the local include should not be used without understanding the userns
+  # restriction.
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/unpriv_bwrap>
+}

profiles/apparmor.d/unshare-userns-restrict

@@ -5,9 +5,46 @@
 # within the user namespace, but its children do not have
 # capabilities, blocking unshare from being able to be used to
 # arbitrarily by-pass the user namespace restrictions.
+# We restrict x mapping of any code that is unknown while unshare
+# has privilige within the namespace. To help ensure unshare can't
+# be used to attack the kernel.
+#
+# disabled by default as it can break some use cases on a system that
+# doesn't have or has disable user namespace restrictions for unconfined
+# use aa-enforce to enable it
+
+abi <abi/4.0>,
+
+include <tunables/global>
 
 profile unshare /usr/bin/unshare flags=(attach_disconnected) {
-    allow capability,
+  # not allow all, to allow for cix transition
+  # and to limit executable mapping to just unshare
+  allow capability,
+  allow file rwlk /{**,},
+  allow network,
+  allow unix,
+  allow ptrace,
+  allow signal,
+  allow mqueue,
+  allow io_uring,
+  allow userns,
+  allow mount,
+  allow umount,
+  allow pivot_root,
+  allow dbus,
+  audit allow cx /** -> unpriv,
+
+  allow file m /usr/lib/@{multiarch}/libc.so.6,
+  allow file m /usr/bin/unshare,
+
+  # the local include should not be used without understanding the userns
+  # restriction.
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/unshare-userns-restrict>
+
+  profile unpriv flags=(attach_disconnected) {
+    # not allow all, to allow for pix stack
     allow file rwlkm /{**,},
     allow network,
     allow unix,
@@ -20,10 +57,9 @@ profile unshare /usr/bin/unshare flags=(attach_disconnected) {
     allow umount,
     allow pivot_root,
     allow dbus,
-    audit allow cx /** -> unpriv_unshare,
 
-    profile unpriv_unshare flags=(attach_disconnected) {
-        allow all,
-	deny capability,
-    }
+    allow pix /** -> &unshare//unpriv,
+
+    audit deny capability,
+  }
 }