BenchExec not working after upgrading from Ubuntu 23.10 to 24.04

[younghojan]

I recently upgraded my system from Ubuntu 23.10 to 24.04, and BenchExec stopped working. I installed BenchExec from the PPA following the instructions provided here. I believe I have configured everything correctly, as python3 -m benchexec.check_cgroups did not produce any output.

However, when I run containerexec --debug /usr/bin/ls, I encounter the following error:

haoranyang@haoranyang-fudan:~/benchexec-younghojan$ containerexec --debug /usr/bin/ls
2024-05-23 20:02:47 - DEBUG - This is containerexec 3.21.
2024-05-23 20:02:47 - INFO - Starting command ls
2024-05-23 20:02:47 - DEBUG - Available Cgroups: {}
2024-05-23 20:02:47 - DEBUG - Starting process.
2024-05-23 20:02:47 - DEBUG - Parent: child process of RunExecutor with PID 12007 started.
2024-05-23 20:02:47 - DEBUG - Child: child process of RunExecutor with PID 12007 started
2024-05-23 20:02:47 - WARNING - Changing hostname in container prevented by system configuration, real hostname will leak into the container.
2024-05-23 20:02:47 - CRITICAL - Failed to configure container with operation 'fcntl.ioctl(sock, _SIOCSIFFLAGS, ifreq)': [Errno 1] Operation not permitted

BenchExec then exits with an error. This seems to be caused by Ubuntu 24.04 now restricting user namespaces by default.

Referencing the Ubuntu 24.04 LTS Release Notes, it states:

In combination with the apparmor package, the Ubuntu kernel now restricts the use of unprivileged user namespaces.

I disabled this restriction by executing:

echo 0 | sudo tee /proc/sys/kernel/apparmor_restrict_unprivileged_userns

However, this solution is temporary and will be reset upon reboot. A persistent setting can be applied by creating a new file /etc/sysctl.d/60-apparmor-namespace.conf with the following contents:

kernel.apparmor_restrict_unprivileged_userns=0

Do we need to update the BenchExec documentation to inform users about this issue and the steps to resolve it on Ubuntu 24.04?

[PhilippWendler]

Thanks! I had heard rumors about this change but haven't found the time to test it yet.

Yes, we definitively want to add documentation about this to BenchExec, and we also want to detect this specific situation in BenchExec itself and print a message that tells users what they need to do (like we do here).

But first, is there a different way how users can make BenchExec work except by re-enabling unprivileged user namespaces globally? Can AppArmor be configured to allow it for BenchExec specifically? Do you happen to know this?

[younghojan]

But first, is there a different way how users can make BenchExec work except by re-enabling unprivileged user namespaces globally? Can AppArmor be configured to allow it for BenchExec specifically? Do you happen to know this?

I guess there's another way to deal with this. It is also mentioned in Ubuntu 24.04 LTS Release Notes referenced above:

Confine your applications with an AppArmor profile. Because this can be potentially onerous, a new unconfined profile mode/flag has been added to AppArmor. This designates the profile to essentially act like the unconfined mode for AppArmor where an application is not restricted, and it allows additional permissions to be added, such as the userns, permission. Such profile for, e.g. Google Chrome 30, would look like the following, and it would be located within the /etc/apparmor.d/chrome file:

abi <abi/4.0>,

include <tunables/global>

/opt/google/chrome/chrome flags=(unconfined) {
 userns,

 # Site-specific additions and overrides. See local/README for details.
 include if exists <local/chrome>
}

Alternatively, a complete AppArmor profile for the application can be created (see the AppArmor 68 documentation).

However, I currently know very little about AppArmor and am not quite sure.

[PhilippWendler]

Ok, I think it would be possible to ship this with our Ubuntu package. But I can't test it right now, and also not all users will install from this package, so we want the added documentation and error messages anyway.

Would you like to contribute this?

[younghojan]

Sure I'd love to! I think I just need to add the corresponding content in the Common Problems section in container.md. I'll have it done in 24 hours.

[PhilippWendler]

Thanks! Would be great if the container code in BenchExec could also detect this particular case.

[PhilippWendler]

Besides the improved error messages regarding this issue, the Ubuntu package of the next release of BenchExec will also ship with the necessary AppArmor config such that BenchExec works out-of-the-box again on Ubuntu. Of course, users of BenchExec who install it from git or pip or use inside a container or so will still need to change the sysctl.