Notes AppArmor

Voir :

https://docs.docker.com/engine/security/apparmor/

The nscd Apparmor profile is not prepared for that and needs some additional capabilities added.

/etc/apparmor.d/openntpd

# vim:syntax=apparmor
#include <tunables/global>

/usr/sbin/ntpd flags=(attach_disconnected) {
  #include <abstractions/base>
  #include <abstractions/nameservice>

  # conf
  /etc/openntpd/ntpd.conf r,

  # capabilities
  capability kill,
  capability sys_chroot,
  capability setgid,
  capability setuid,
  capability sys_time,
  capability sys_nice,

  /usr/sbin/ntpd mrix,
  /var/lib/openntpd/db/ntpd.drift rw,
  /var/lib/openntpd/run/ntpd.sock rw,

}

Necessary changes are: /etc/nscd.conf

        server-user             nobody

/etc/apparmor.d/usr.sbin.nscd

          capability setgid,
          capability setuid,

After adding these lines, restart Apparmor and subsequently nscd

source : https://www.suse.com/fr-fr/support/kb/doc/?id=000017971

K3S rootless

cat <<EOF | sudo tee "/etc/apparmor.d/usr.local.bin.k3s"
abi <abi/4.0>,
include <tunables/global>
 
/usr/local/bin/k3s flags=(unconfined) {
  userns,
 
  include if exists <local/usr.local.bin.k3s>
}
EOF
 
sudo systemctl restart apparmor.service

Source : https://docs.k3s.io/advanced