Sandbox: In ubuntu 24.04, bwrap fails fails to create user namespace if apparmor profile is not loaded that grants the access.

[dileepyavan]

Ubuntu AppArmor note: On Ubuntu 25.04, installing bubblewrap from Ubuntu’s package repository should work without extra AppArmor setup. The bwrap-userns-restrict profile ships in the apparmor package at /etc/apparmor.d/bwrap-userns-restrict.

On Ubuntu 24.04, Copy and load the extra profile:

sudo apt update
sudo apt install apparmor-profiles apparmor-utils
sudo install -m 0644
/usr/share/apparmor/extra-profiles/bwrap-userns-restrict
/etc/apparmor.d/bwrap-userns-restrict
sudo apparmor_parser -r /etc/apparmor.d/bwrap-userns-restrict

apparmor_parser -r loads the profile into the kernel without a reboot. You can also reload all AppArmor profiles:

sudo systemctl reload apparmor.service

If that profile is unavailable or does not resolve the issue, you can disable the AppArmor unprivileged user namespace restriction with:

sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0

[8bpdkhpryv-pixel]

Is this to stop the damn rootkit I've been fighting for the last week? It changes the extension manifest allowing remote access, drops in authorized keys in 9 sysctrl folders and takes sudo over installing 1000 + user names.
First on Microsoft-- wiped it
Went to Linux -- language server-x64 from vs code ported in thru Windsurf.

[isidorn]

Dileep Yavanmandha (@dileepyavan) I am moving this to backlog. If you think this is something we must fix, please comment and we can put it back to the Current Iteration