From 3a890a678fbeb930d41274c0258c1905f43cc068 Mon Sep 17 00:00:00 2001 From: Sevinj Aghayeva Date: Mon, 7 Sep 2026 14:39:37 -0700 Subject: contrib/apparmor: add missing setfcap capability Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map requires CAP_SETFCAP. isolation.c already retains this capability for the case where pasta spawns a child from a non-init user namespace, but the AppArmor profile doesn't grant it, so the write is denied whenever the profile is enforced. Add setfcap to the AppArmor abstraction to match what isolation.c expects. Link: https://bugs.passt.top/show_bug.cgi?id=172 Signed-off-by: Sevinj Aghayeva Signed-off-by: Stefano Brivio --- contrib/apparmor/abstractions/passt | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index 85bd1ee..f4570c1 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -24,6 +24,7 @@ capability setpcap, capability net_admin, capability sys_ptrace, + capability setfcap, userns, / r, # isolate_prefork(), isolation.c -- cgit v1.2.3