From 94c3166a7f9469a6bca9ed5b26186ffed0a33fce Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Tue, 6 Oct 2026 10:57:21 +0200 Subject: [PATCH] docs: describe nested namespaces in jobs and add optional userns rule --- examples/deploy/nsjail-security-profiles/README.md | 6 +++++- .../nsjail-security-profiles/windmill-nsjail.apparmor | 4 ++++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/examples/deploy/nsjail-security-profiles/README.md b/examples/deploy/nsjail-security-profiles/README.md index d1a696820c..1b2993d56f 100644 --- a/examples/deploy/nsjail-security-profiles/README.md +++ b/examples/deploy/nsjail-security-profiles/README.md @@ -28,6 +28,8 @@ sudo install -m 0644 windmill-nsjail.apparmor /etc/apparmor.d/windmill-nsjail sudo apparmor_parser -r /etc/apparmor.d/windmill-nsjail ``` +If the node's audit log shows AppArmor denying `userns_create` for the worker, uncomment the `userns,` rule in the profile (it needs AppArmor 4.0 or later, older parsers reject it) and reload it. + A pod that references a profile missing from its node fails to start, so node groups that autoscale need these steps in their bootstrap or in a DaemonSet. On nodes without AppArmor, remove the `appArmorProfile` block from the pod settings. ## Using the profiles with Docker @@ -57,7 +59,9 @@ docker run \ ## What the profiles give up -Jobs inherit the seccomp filter, so job code can also call `clone` with namespace flags and `mount`, which the runtime default denies to a container without `SYS_ADMIN`. The AppArmor profile no longer denies mounts, so its path rules on `/proc` and `/sys` do not hold against a process that has the capability to mount: with `kubernetes-sys-admin.yaml` that is the worker, never a job. Both remain far narrower than `Unconfined` or `privileged: true`. +Jobs inherit the seccomp filter, so job code can also call `clone` with namespace flags and `mount`, which the runtime default denies to a container without `SYS_ADMIN`. Where the kernel allows unprivileged user namespaces, a job can therefore create a nested user and mount namespace and mount filesystems inside it. This grants nothing outside that namespace, but it exposes more of the kernel to job code than the runtime default does. + +The AppArmor profile no longer denies mounts, so its path rules on `/proc` and `/sys` do not hold against a process that can mount those filesystems elsewhere. Both profiles remain far narrower than `Unconfined` or `privileged: true`. ## Regenerating the seccomp profile diff --git a/examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor b/examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor index a4bfc6080a..97ff10b02f 100644 --- a/examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor +++ b/examples/deploy/nsjail-security-profiles/windmill-nsjail.apparmor @@ -14,6 +14,10 @@ profile windmill-nsjail flags=(attach_disconnected,mediate_deleted) { umount, pivot_root, + # Needed where AppArmor mediates user namespace creation for this profile. + # AppArmor parsers older than 4.0 reject the rule, hence commented out. + # userns, + signal (receive) peer=unconfined, signal (receive) peer=runc, signal (receive) peer=crun,