From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: passt.top; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20251104 header.b=J0jUx743; dkim-atps=neutral Received: from mail-pj1-x102b.google.com (mail-pj1-x102b.google.com [IPv6:2607:f8b0:4864:20::102b]) by passt.top (Postfix) with ESMTPS id D6EE15A0265 for ; Mon, 07 Sep 2026 23:39:45 +0200 (CEST) Received: by mail-pj1-x102b.google.com with SMTP id 98e67ed59e1d1-3964e480f76so4568933a91.1 for ; Mon, 07 Sep 2026 14:39:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788817184; x=1789421984; darn=passt.top; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=luvj5i7l9/gcaBR/5GTwQs1xRXWaR6svDPCU7+LXLIU=; b=J0jUx743s62LiJGS59glrykPpy+UUqdLli2/1jLFu4CTaJQoQEJflqN02wMK8VXHly 57QLxsCgiUr8LRxFwYSLgpSfwbRnH0zk2rfXVL0YU6R2UQV+HX98YxIuVFw/LWNfmsOe mR99QsRkfGG6q23Q9Z0M7A27RdkX0lGG7iHB34Hz/ELlYYCbgQdedy20/0KKplQunyBo wRTeqg5UTUO5dkjP5hOMyGe1YLSJ5TDhM8cTYmuchzxJxLFwlaToPDbGtmKgoF1gYrDU nejl/brsM+iSbNS+/9RkQQpE6tLBxP1t3cRe42LP7XGhXQcfmpN+e9tpSg3NE5OKdjCA 8yzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788817184; x=1789421984; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=luvj5i7l9/gcaBR/5GTwQs1xRXWaR6svDPCU7+LXLIU=; b=Fxzk/nYNFCb3+QeqWCGUfqkOksLLnFETZIT0RFrlmQvKcCLD+jszKfea9/5FCP45NB OriqKA9BASCeckU0sgYiUm2pQiT10hD2FgTU7fqJUkk9KFY1bD85nAQsCKlIggd94d8V LI2yr9MklKDHcIuTvs90yK13uevG5xoLOpyVF1YAHBgyebV7xCeeAAChTwpp7SZvyLt+ by7PnmtlOW7zSLnQOMRN7a3N/YiWdFaOI8BDF+A1p5ncRY9QcwILo0iFw7zW6HhqnXWA /DsL2FW3y5l+fACm7tiVYrlVbFhGIKf/ZMF/SARBU865Tu7tV76+3e0k+zTgly7DzhuH KtlA== X-Gm-Message-State: AFuF++nFDhZZOAMNg8Ha2VqW8VrQKRm9+AkVuwOzzw5wdqOMohkfbnhw uZK+UE6EMaBacQRVK2p+wS+cVp1yJmsv6F1NymB6u34MQrT3McyNSRBB8kIg8g== X-Gm-Gg: AYBFou2W5L/rfP7TYgFd+l+503CPVQPxI2BGxvrpP1oHYI8YbPDDtQDRx8GDHMK3U3z vZEU07GgTte3RCKWvL6i+vk7sY30z77t/JdtUL70aa0atjEqerOFnZ1ePHF7HI1BdOUjNg+EQ1S Mn/xZSnDHmkymDRFrZBI+7lE+iH6zI9at5jwVwhP7mGVnUwuaDAnLWfHUk6etxy8QC93g3owcg9 ZtdLthNLDMIt1d9WXhEz08QZv1RdlzatqhNbhp1g8Vy3rSxInwGfHBxsUO6lbsZNxKPCmIemKBz 2Rn+YlD3GPxPZt+mJo1uudY4W1hImX/7gTq1z1GV0MVTNh4rsFpFDcRMkSljog/ZXkVo5YR2iFo v3xjKsjN9wNZqJVqw3NnUlHcX3a2z9E1W5T04bWQscd0f4nIujgnIk8/30y4kCx/lbfGOcAIwdg U+SyZ1ngVUczRpoJpa22YpqkqJP+labgN7xE+ALvT76pSEA/htP33WgmbMcxXuInslP3+Rjee8B gdZaL4mHJTXAsBu4mQ= X-Received: by 2002:a17:90b:5344:b0:38e:4f41:83df with SMTP id 98e67ed59e1d1-39b261e0f14mr38055815a91.15.1788817184301; Mon, 07 Sep 2026 14:39:44 -0700 (PDT) Received: from ada.lan ([50.35.77.235]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-39b08bcc090sm28527068a91.4.2026.09.07.14.39.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 07 Sep 2026 14:39:44 -0700 (PDT) From: Sevinj Aghayeva To: passt-dev@passt.top Subject: [PATCH] contrib/apparmor: add missing setfcap capability Date: Mon, 7 Sep 2026 14:39:37 -0700 Message-ID: <20260907213938.1161149-1-sevinj.aghayeva@gmail.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MailFrom: sevinj.aghayeva@gmail.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: KBMSIFSMPF4PU2JSNSPEHAFASSATBGIP X-Message-ID-Hash: KBMSIFSMPF4PU2JSNSPEHAFASSATBGIP X-Mailman-Approved-At: Tue, 08 Sep 2026 02:20:56 +0200 CC: sbrivio@redhat.com, Sevinj Aghayeva X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map requires CAP_SETFCAP. isolation.c already retains this capability for the case where pasta spawns a child from a non-init user namespace, but the AppArmor profile doesn't grant it, so the write is denied whenever the profile is enforced. Add setfcap to the AppArmor abstraction to match what isolation.c expects. Link: https://bugs.passt.top/show_bug.cgi?id=172 Signed-off-by: Sevinj Aghayeva --- contrib/apparmor/abstractions/passt | 1 + 1 file changed, 1 insertion(+) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index 85bd1ee..f4570c1 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -24,6 +24,7 @@ capability setpcap, capability net_admin, capability sys_ptrace, + capability setfcap, userns, / r, # isolate_prefork(), isolation.c -- 2.43.0