On Mon, 7 Sep 2026 14:39:37 -0700
Sevinj Aghayeva
Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map requires CAP_SETFCAP. isolation.c already retains this capability for the case where pasta spawns a child from a non-init user namespace, but the AppArmor profile doesn't grant it, so the write is denied whenever the profile is enforced.
Add setfcap to the AppArmor abstraction to match what isolation.c expects.
Link: https://bugs.passt.top/show_bug.cgi?id=172 Signed-off-by: Sevinj Aghayeva
Applied, thanks for the patch, and welcome to the git log! I just played for a while with nested pasta on Debian, and finally stuff like: $ pasta --config-net -- pasta --config-net ping -c1 2600:: works with AppArmor as well. I'll take care of closing https://bugs.passt.top/show_bug.cgi?id=172 once your fix is released. -- Stefano