feat(minimald): ship an AppArmor profile granting minimald userns - #740

…-minimald

native-daemon-e2e lifted Ubuntu's unprivileged-userns restriction
(`sysctl ...=0`) on the theory that the session sandbox needs it. It does
not: session-e2e.sh drives activate/list/destroy/stop only and never
forks a session sandbox, so the job needs no user namespace — verified by
running the e2e green with the restriction left on. Remove the step and
leave a comment so it is not re-added; correct the job header, which
wrongly claimed the e2e execs inside the sandbox (it does not — that path
is proven in Rust, per session-e2e.sh).

Sandbox-forking coverage that genuinely needs userns stays put: the
workspace tests and the minimald-root-integration job (whose own sysctl
step is unaffected — its userns comes from the cargo test binary, not
minimald).

Refs: #610

The curl|sh installer had no path to the AppArmor profile that lets
minimald create the unprivileged user namespace every session sandbox
needs: the profile and its loader lived only in the source tree, so
`sudo scripts/install-apparmor-profile.sh` was a dead reference for
anyone who installed via curl|sh. On stock Ubuntu 24.04+ that left every
session dying at uid_map with an opaque EPERM and no in-product hint.

Plumb it in without ever elevating from the installer:

- stage-release.sh ships packaging/apparmor/{minimald,tunables/minimald}
  and install-apparmor-profile.sh as data-prefix components, installed to
  ~/.local/share/minimal/apparmor/.
- install.sh prints a gated, Linux-only advisory when it detects
  apparmor_restrict_unprivileged_userns=1, pointing at the shipped loader
  (sudo bash ...). Advice only; it never runs sudo.
- On --uninstall, offer to remove the system profile too: prompt on a
  terminal, advise the root command otherwise, run before the record walk
  deletes the loader. Never touches /etc/apparmor.d unattended.
- install-apparmor-profile.sh resolves its source dir from either the
  checkout layout or the shipped-flat layout.
- The install loop now creates each component's parent dir, so a
  component whose subpath nests directories installs correctly.

install_test.sh covers placement, the advisory on/off, darwin-skip, and
the uninstall advisory (no elevation, loader removed).

Refs: #610

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

The install-time advisory checked only the sysctl and the shipped
loader, so a reinstall on an already-remediated host still claimed the
sandbox "cannot start" — the profile is loaded and sessions work, yet
the sysctl stays 1. Gate the advisory on the absence of the installed
profile at /etc/apparmor.d/minimald (via the same MINIMAL_OVERRIDE_-
APPARMOR_DIR seam the uninstall path uses), so it fires only on a host
that is restricted and not yet remediated.

Also show the loader's output in the curl-installed docs example, so the
command block carries output like its sibling (satisfies markdownlint
MD014).

Both raised by CodeRabbit on #740.

…tartup

Every session sandbox starts by unsharing an unprivileged user
namespace, forked from the daemon with no exec in between. On a host
that refuses it (stock Ubuntu 24.04+ with an unconfined daemon, or user
namespaces disabled outright) the denial previously surfaced only when
the first attach died writing /proc/self/uid_map, with nothing useful
in the daemon log.

sandbox2 gains user_namespaces_restriction() — a read-only probe of the
userns quota, the apparmor_restrict_unprivileged_userns sysctl, euid,
and the process's own AppArmor label, mirroring the crate's existing
net-namespace probe — and minimald warns at startup naming the
restriction and the exact fix. Root (the in-guest microVM pid-1) and
confined daemons stay silent, so the common case logs nothing.

Refs: #610

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The reference docs ship to https://docs.minimal.dev/ with this release,
so the advisory's details link should point there rather than at a
GitHub blob URL. The build-specs link to minimal.ncl stays on GitHub:
it targets source, not a hosted doc page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… running binary

The startup warning hardcoded ~/.local/share for the shipped loader, so
the advised command was wrong whenever XDG_DATA_HOME was set, and it
omitted --path, so a daemon outside the tunable's stock attachment set
(a custom MINIMAL_BIN, a dev build) was told to load a profile that
would never attach to it. paths gains minimal_data_dir(), resolving
exactly like the installer's data prefix, and the fix string now carries
--path <current_exe>.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

The parse loop consumes $@ before the root check, so the hinted
`sudo $0 $*` always printed bare — a copy-pasted retry of
--uninstall would install, and one of --path would skip the attachment.
Capture the original argv up front and print that.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

… only for bin/lib swaps

Two review findings against the advisory and the R5.5 stop:

- The stock tunable attaches only /usr/bin, /usr/local/bin, and
  ~/.local/bin, so for a custom MINIMAL_BIN the advised command now
  carries --path "$bindir/minimald", and a loaded profile counts as
  remediation only when the tunables actually name that binary —
  previously the advisory suppressed itself while sessions stayed
  broken.
- stop_running_daemon now fires only for bin/lib component swaps:
  replacing a data file (the shipped apparmor text) must not kill live
  sessions to swap a file the running daemon does not serve from.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…nothing

stage_repo_file wrote the three apparmor files into ARTIFACTS_DIR before
the dry-run branch, mutating a directory the caller owns (and dying
outright when it is read-only). Stage into the ephemeral workdir and let
the manifest loop prefer staged files over same-named artifacts.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…ox proof

The native-e2e lane dropped its userns sysctl step on the rationale that
session-e2e.sh forks no sandbox — true when written, falsified by the
in-sandbox `min add` proof (#760) merged since: on a restricted runner
the proof's sandbox dies at uid_map and surfaces as the misleading
'jq was already present' error (the absent-marker never prints).

Load the shipped profile from the script itself, attached to the
minimald the run will spawn — dogfooding the documented remediation on
CI and on any restricted host running the e2e locally. Native Linux
only: VM lanes create their userns in-guest as root.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>