[PR #7080] modif: allow `userns` in firejail-default apparmor profile #6308

New issue

Open

opened 2026-05-05 10:54:32 -06:00 by gitea-mirror · 0 comments

gitea-mirror commented

2026-05-05 10:54:32 -06:00

Owner

📋 Pull Request Information

Original PR: https://github.com/netblue30/firejail/pull/7080
Author: @cobratbq
Created: 2/25/2026
Status: 🔄 Open

Base: master ← Head: grant-userns-to-firejail

📝 Commits (2)

9c7189d apparmor: grant userns to firejail process
03a3c96 apparmor: add comments to the AppArmor profile addition

📊 Changes

1 file changed (+7 additions, -0 deletions)

View changed files

📝 etc/apparmor/firejail-default (+7 -0)

📄 Description

Add userns to the AppArmor profile for firejail, such that with AppArmor enforcing restrictions, firejail is granted sufficient permissions to exert full control over the capabilities and permissions it is managing.

Fixes: #7078

question: Is the child-process of firejail already properly handled w.r.t. the AppArmor profile? Already before this patch, the spawned firejail child-process would likely be subjected to some influence from apparmor, or not?

The open question should not matter more/less specifically for this patch.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/netblue30/firejail/pull/7080 **Author:** [@cobratbq](https://github.com/cobratbq) **Created:** 2/25/2026 **Status:** 🔄 Open **Base:** `master` ← **Head:** `grant-userns-to-firejail` --- ### 📝 Commits (2) - [`9c7189d`](https://github.com/netblue30/firejail/commit/9c7189dd43f8ca49b9b2c65c80fd5601cd5a5d99) apparmor: grant userns to firejail process - [`03a3c96`](https://github.com/netblue30/firejail/commit/03a3c96653bffc9495214b295bcaad5f16aae52c) apparmor: add comments to the AppArmor profile addition ### 📊 Changes **1 file changed** (+7 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `etc/apparmor/firejail-default` (+7 -0) </details> ### 📄 Description Add `userns` to the AppArmor profile for firejail, such that with AppArmor enforcing restrictions, firejail is granted sufficient permissions to exert full control over the capabilities and permissions it is managing. Fixes: #7078 - question: Is the child-process of firejail already properly handled w.r.t. the AppArmor profile? Already before this patch, the spawned `firejail` child-process would likely be subjected to some influence from apparmor, or not? The open question should not matter more/less specifically for this patch. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

gitea-mirror added the

pull-request

label 2026-05-05 10:54:32 -06:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference: github-starred/firejail#6308

No description provided.

Rows
Columns

[PR #7080] modif: allow userns in firejail-default apparmor profile #6308

📋 Pull Request Information

📝 Commits (2)

📊 Changes

📄 Description

[PR #7080] modif: allow `userns` in firejail-default apparmor profile #6308