Enum UsernsGrant 

pub enum UsernsGrant {
    ApparmorAbsent,
    RestrictionDisabledHostWide,
    ProfileConfining,
    Withheld,
}

Where this host’s permission to create an unprivileged user namespace comes from.

Three of the four variants permit the namespace, and they are not interchangeable: AppArmor being absent is a distribution fact nobody chose, the shipped profile confining mur is the configuration murmur ships, and the restriction being switched off host-wide removes the hardening for every binary on the machine. The three reach the same achieved class, so mur doctor, --explain-scope and the session trace each report the variant: without it a sealed result obtained on a weakened host cannot be told apart from one obtained through the profile.

The grant never decides anything: whether a namespace, a private /tmp or sealed is available is decided by crate::namespace_probe creating them. The grant only words a refusal once an attempt has failed.

Variants

ApparmorAbsent

AppArmor is not enabled on this host (Fedora, Arch, a kernel built without it, …). There is no restriction to lift and no profile to install.

RestrictionDisabledHostWide

AppArmor is enabled but kernel.apparmor_restrict_unprivileged_userns is 0, so no binary on this host is transitioned into the restricted unprivileged_userns profile. Legitimate, and on some hosts the only option — but it is not the configuration murmur ships, and it is what W-SEC-013 reports.

ProfileConfining

The restriction is on and this process is confined by a profile whose name begins with SEALED_APPARMOR_PROFILE_NAME — the shipped profile, or the checkout profile scripts/install-dev-apparmor.sh generates. The grant is narrow: it applies to this binary and nothing else.

Withheld

The restriction is on and nothing grants this binary anything. A container whose own profile permits user namespaces reads this too, and is not refused for it. The default, so an unprobed host claims nothing.

Implementations

impl UsernsGrant

pub const ALL: &'static [UsernsGrant]

Every variant, so a caller reasoning about “which grant did this host give” cannot silently miss one. Same convention as SealedBlocker::ALL.

pub fn wire_name(self) -> &'static str

Stable wire name, as it appears in --explain-scope --json, in session_start and in mur doctor. Distinct per variant, and not a Debug rendering, which is free to change.

pub fn summary(self) -> &'static str

One line naming the mechanism in words, for the mur doctor block. States what the grant covers — one binary or the whole host — because that is the difference the wire name alone does not spell out.

pub fn from_readings( enabled: Option<&str>, restricted: Option<&str>, current_profile: Option<&str>, ) -> UsernsGrant

The whole decision, over the three host readings that produce it: whether AppArmor is enabled, whether its restrict_unprivileged_userns knob is on, and what profile confines this process. Each argument is the file’s trimmed contents, or None when it is missing or empty.

Pure, and separate from the reading for the same reason classify_installed_profile is: every combination is then testable on any OS, with no /sys and no /proc. linux::userns_grant is the reader and holds no logic of its own.

A missing or unreadable restriction knob counts as not restricted, not as withheld — a kernel that does not implement the knob does not restrict anything.

Trait Implementations

impl Clone for UsernsGrant

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for UsernsGrant

impl Debug for UsernsGrant

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for UsernsGrant

fn default() -> Self

Returns the “default value” for a type.

impl Eq for UsernsGrant

impl Hash for UsernsGrant

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl PartialEq for UsernsGrant

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for UsernsGrant

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for UsernsGrant