Public bug reported:
During apt upgrade on Ubuntu 24.04 (noble), configuring apparmor
4.0.1really4.0.1-0ubuntu0.24.04.9 prints:
/var/lib/dpkg/info/apparmor.postinst: 148: [: Illegal number: yes
The postinst sources /lib/apparmor/rc.apparmor.functions, and the error
comes from line 148 of that file, in check_userns():
unconfined_userns=$([ -f
/sys/kernel/security/apparmor/features/policy/unconfined_restrictions/userns ]
&& cat
/sys/kernel/security/apparmor/features/policy/unconfined_restrictions/userns ||
echo 0)
...
if [ "$unconfined_userns" -eq 0 ]; then
The code assumes the sysfs file contains 0 or 1, but on this kernel it
contains yes:
# uname -r
Linux ns3 6.8.0-146-generic #146-Ubuntu SMP PREEMPT_DYNAMIC Thu Sep 3 16:12:30
UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
# cat
/sys/kernel/security/apparmor/features/policy/unconfined_restrictions/userns
yes
# lsb_release -rd
No LSB modules are available.
Description: Ubuntu 24.04.5 LTS
Release: 24.04
Under dash, [ yes -eq 0 ] is an error (exit 2), which if treats as
false. On a kernel reporting yes, that happens to produce the right
result (restrictions are left enabled). On a kernel reporting no,
however, the test also fails, so the script never disables
kernel.apparmor_restrict_unprivileged_userns when unconfined userns is
unsupported. That’s the exact case the function exists to handle.
ProblemType: Bug
DistroRelease: Ubuntu 24.04
Package: apparmor 4.0.1really4.0.1-0ubuntu0.24.04.9
ProcVersionSignature: Ubuntu 6.8.0-146.146-generic 6.8.12
Uname: Linux 6.8.0-146-generic x86_64
ApportVersion: 2.28.3-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CloudArchitecture: x86_64
CloudID: vultr
CloudName: vultr
CloudPlatform: vultr
CloudRegion: us
CloudSubPlatform: unknown
Date: Tue Oct 20 23:12:51 2026
InstallationDate: Installed on 2022-01-15 (1740 days ago)
InstallationMedia: Ubuntu-Server 21.10 "Impish Indri" - Release amd64 (20211013)
ProcEnviron:
LANG=en_US.UTF-8
PATH=(custom, no user)
SHELL=/bin/bash
TERM=xterm
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-6.8.0-146-generic
root=UUID=2e441554-5606-4ab9-a862-46b1ba0f1e7c ro vultr
RebootRequiredPkgs: Error: path contained symlinks.
SourcePackage: apparmor
Syslog:
UpgradeStatus: Upgraded to noble on 2024-09-21 (759 days ago)
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-bug noble
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2171580
Title:
check_userns in rc.apparmor.functions fails with “Illegal number: yes”
when kernel reports unconfined_restrictions/userns as yes/no
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2171580/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
