[PATCH] contrib/apparmor: add missing setfcap capability

[PATCH] contrib/apparmor: add missing setfcap capability

[Sevinj Aghayeva]

Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map
requires CAP_SETFCAP. isolation.c already retains this capability for
the case where pasta spawns a child from a non-init user namespace,
but the AppArmor profile doesn't grant it, so the write is denied
whenever the profile is enforced.

Add setfcap to the AppArmor abstraction to match what isolation.c
expects.

Link: https://bugs.passt.top/show_bug.cgi?id=172
Signed-off-by: Sevinj Aghayeva <sevinj.aghayeva@gmail.com>
---
 contrib/apparmor/abstractions/passt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt
index 85bd1ee..f4570c1 100644
--- a/contrib/apparmor/abstractions/passt
+++ b/contrib/apparmor/abstractions/passt
@@ -24,6 +24,7 @@
   capability setpcap,
   capability net_admin,
   capability sys_ptrace,
+  capability setfcap,
   userns,
 
   /					r,	# isolate_prefork(), isolation.c
-- 
2.43.0

Re: [PATCH] contrib/apparmor: add missing setfcap capability

[Stefano Brivio]

On Mon,  7 Sep 2026 14:39:37 -0700
Sevinj Aghayeva <sevinj.aghayeva@gmail.com> wrote:

> Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map
> requires CAP_SETFCAP. isolation.c already retains this capability for
> the case where pasta spawns a child from a non-init user namespace,
> but the AppArmor profile doesn't grant it, so the write is denied
> whenever the profile is enforced.
> 
> Add setfcap to the AppArmor abstraction to match what isolation.c
> expects.
> 
> Link: https://bugs.passt.top/show_bug.cgi?id=172
> Signed-off-by: Sevinj Aghayeva <sevinj.aghayeva@gmail.com>

Applied, thanks for the patch, and welcome to the git log!

I just played for a while with nested pasta on Debian, and finally
stuff like:

  $ pasta --config-net -- pasta --config-net ping -c1 2600::

works with AppArmor as well.

I'll take care of closing https://bugs.passt.top/show_bug.cgi?id=172
once your fix is released.

-- 
Stefano