Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map requires CAP_SETFCAP. isolation.c already retains this capability for the case where pasta spawns a child from a non-init user namespace, but the AppArmor profile doesn't grant it, so the write is denied whenever the profile is enforced. Add setfcap to the AppArmor abstraction to match what isolation.c expects. Link: https://bugs.passt.top/show_bug.cgi?id=172 Signed-off-by: Sevinj Aghayeva --- contrib/apparmor/abstractions/passt | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index 85bd1ee..f4570c1 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -24,6 +24,7 @@ capability setpcap, capability net_admin, capability sys_ptrace, + capability setfcap, userns, / r, # isolate_prefork(), isolation.c -- 2.43.0