Add sysctl_kernel_apparmor_restrict_unprivileged_unconfined rule

[israel-villar]

Add a new rule and variable to enforce
kernel.apparmor_restrict_unprivileged_unconfined=1 via the sysctl template. This sysctl prevents unprivileged processes from loading AppArmor profiles without confinement, reducing the local attack surface. Map the new rule to the apparmor component.

Description:

• Add new rule sysctl_kernel_apparmor_restrict_unprivileged_unconfined
  and its associated variable
  sysctl_kernel_apparmor_restrict_unprivileged_unconfined_value.var
  to enforce kernel.apparmor_restrict_unprivileged_unconfined=1.
• Uses the sysctl template.
• Map the new rule to the apparmor component.

Rationale:

• When kernel.apparmor_restrict_unprivileged_unconfined is set to 1,
  unprivileged processes are prevented from loading AppArmor profiles
  without confinement. This reduces the local attack surface by limiting
  what an unprivileged user can do with AppArmor.

Review Hints:

• One new rule directory and one .var file under
  linux_os/guide/system/permissions/restrictions/.
• Build to verify: ./build_product debian13 --datastream-only

[openshift-ci]

Hi @israel-villar. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[jan-cerny]

Is 2 a valid value for this sysctl item? Shouldn't the choice be 0 and 1?

[israel-villar]

You are right, kernel.apparmor_restrict_unprivileged_unconfined is a boolean — 0 (disabled) and 1 enabled). The value 2 was mistakenly copied from a similar variable (sysctl_kernel_unprivileged_bpf_disabled) that does accept 1 and 2. Fixed in the latest commit.

[jan-cerny]

@israel-villar CI fails

102/261 Test #100: components .......................................................***Failed    0.70 sec
Rule 'sysctl_kernel_apparmor_restrict_unprivileged_unconfined' must be assigned to component 'kernel', because all rules using template 'sysctl' must be assigned to component 'kernel'.

[israel-villar]

@israel-villar CI fails

102/261 Test #100: components .......................................................***Failed    0.70 sec
Rule 'sysctl_kernel_apparmor_restrict_unprivileged_unconfined' must be assigned to component 'kernel', because all rules using template 'sysctl' must be assigned to component 'kernel'.

Moved sysctl_kernel_apparmor_restrict_unprivileged_unconfined from components/apparmor.yml to components/kernel.yml