* [PATCH] contrib/apparmor: add missing setfcap capability
@ 2026-09-07 21:39 Sevinj Aghayeva
0 siblings, 0 replies; only message in thread
From: Sevinj Aghayeva @ 2026-09-07 21:39 UTC (permalink / raw)
To: passt-dev; +Cc: sbrivio, Sevinj Aghayeva
Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map
requires CAP_SETFCAP. isolation.c already retains this capability for
the case where pasta spawns a child from a non-init user namespace,
but the AppArmor profile doesn't grant it, so the write is denied
whenever the profile is enforced.
Add setfcap to the AppArmor abstraction to match what isolation.c
expects.
Link: https://bugs.passt.top/show_bug.cgi?id=172
Signed-off-by: Sevinj Aghayeva <sevinj.aghayeva@gmail.com>
---
contrib/apparmor/abstractions/passt | 1 +
1 file changed, 1 insertion(+)
diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt
index 85bd1ee..f4570c1 100644
--- a/contrib/apparmor/abstractions/passt
+++ b/contrib/apparmor/abstractions/passt
@@ -24,6 +24,7 @@
capability setpcap,
capability net_admin,
capability sys_ptrace,
+ capability setfcap,
userns,
/ r, # isolate_prefork(), isolation.c
--
2.43.0
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-09-07 21:39 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-07 21:39 [PATCH] contrib/apparmor: add missing setfcap capability Sevinj Aghayeva
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).