Hi Hamish, On Fri, 7 Jun 2024 20:45:39 +1000 hamish-passt(a)moffatt.email wrote:Hi, I have podman 5.1.0 and passt 0.0+20240523.765eb0bf running on Debian bookworm (via unofficial packages). When I try to run podman using passt for networking, it is blocked by apparmor (3.0.8). audit: type=1400 audit(1717756950.285:65): apparmor="DENIED" operation="open" profile="passt" name="/run/user/1000/netns/netns-cad489f7-d3c4-7730-9d15-17ae8e172da4" pid=246135 comm="passt.avx2" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0 I'm not familiar with apparmor so I don't know how to debug this. The installed apparmor profile files match the ones in the pasta git. Can you help?Thanks for your report. I think the issue is caused by the fact that, with the package you're using, pasta is associated with the "passt" profile, which is the profile for passt(1) mode, instead of the usr.bin.pasta profile: look at the "profile" string in the AppArmor message you shared. I fixed this in the official Debian packages here, a while ago: https://salsa.debian.org/sbrivio/passt/-/commit/5bb812e79143670a57440cd8aa7… Which unofficial packages are you using? On Debian Bookworm, I think you could simply use the official version from testing, 0.0~git20240523.765eb0b-1, see also: https://tracker.debian.org/pkg/passt -- Stefano