Print hints if kernel.apparmor_restrict_unprivileged_userns is set

[AkihiroSuda]

For:

• rootless: update docs and containerd-rootless-setuptool.sh check for Ubuntu 24.04 (kernel.apparmor_restrict_unprivileged_userns) containerd/nerdctl#2847
• rootless (non-dpkg): update docs and dockerd-rootless-setuptool.sh check for Ubuntu 24.04 (kernel.apparmor_restrict_unprivileged_userns) moby/moby#47480

Example output:

$ ~/bin/rootlesskit bash
WARN[0000] [rootlesskit:parent] This error might have happened because /proc/sys/kernel/apparmor_restrict_unprivileged_userns is set to 1  error="fork/exec /proc/self/exe: permission denied"
WARN[0000] [rootlesskit:parent] Hint: try running the following commands:


########## BEGIN ##########
cat <<EOT | sudo tee "/etc/apparmor.d/home.suda.bin.rootlesskit"
# ref: https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
abi <abi/4.0>,
include <tunables/global>

/home/suda/bin/rootlesskit flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/home.suda.bin.rootlesskit>
}
EOT
sudo systemctl restart apparmor.service
########## END ##########
 
[rootlesskit:parent] error: failed to start the child: fork/exec /proc/self/exe: permission denied