<html> <head> <meta http-equiv="content-type" content="text/html; charset=UTF-8"> </head> <body> <div dir="auto">Hello,<br></div><div dir="auto">I recently started experimenting with AppArmor and have successfully created profiles for several applications. However, I encountered an issue while profiling Steam. Specifically, Steam fails to launch when AppArmor is enabled. Below is the error output from Steam:<br></div><div dir="auto">```<br></div><div dir="auto">steam.sh[204656]: Running Steam on arch rolling 64-bit<br></div><div dir="auto">steam.sh[204656]: STEAM_RUNTIME is enabled automatically<br></div><div dir="auto">setup.sh[204732]: Steam runtime environment up-to-date!<br></div><div dir="auto">steam-runtime-check-requirements[206680]: W: Child process exited with code 1: bwrap: setting up uid map: Permission denied<br></div><div dir="auto"><br></div><div dir="auto">steam.sh[204656]: Error: Steam now requires user namespaces to be enabled.<br></div><div dir="auto"><br></div><div dir="auto">This requirement is the same as for Flatpak, which has more detailed<br></div><div dir="auto">information available:<br></div><div dir="auto"><a href="https://github.com/flatpak/flatpak/wiki/User-namespace-requirements" rel="noopener noreferrer" target="_blank">https://github.com/flatpak/flatpak/wiki/User-namespace-requirements</a><br></div><div dir="auto">```<br></div><div dir="auto"><br></div><div dir="auto">From the URL provided in the output, I quickly figured out It is an issue related to bubblewrap.<br></div><div dir="auto"><br></div><div dir="auto">Below is the output of bwrap when it's profile is set to complain mode:<br></div><div dir="auto">```<br></div><div dir="auto"> >> bwrap --bind / / --ro-bind /usr /usr --dev /dev --proc /proc --dir /tmp --unshare-user<br></div><div dir="auto">--unshare-net --unshare-pid /bin/bash --expose-pids<br></div><div dir="auto">bwrap: setting up uid map: Permission denied<br></div><div dir="auto">```<br></div><div dir="auto"><br></div><div dir="auto">Here is the AppArmor profile I have configured for bwrap:<br></div><div dir="auto">```<br></div><div dir="auto">abi <abi/4.0>,<br></div><div dir="auto">include <tunables/global><br></div><div dir="auto"><br></div><div dir="auto">profile bwrap /usr/bin/bwrap flags=(complain) {<br></div><div dir="auto"> userns,<br></div><div dir="auto"><br></div><div dir="auto"> # Site-specific additions and overrides. See local/README for details.<br></div><div dir="auto"> include if exists <local/bwrap><br></div><div dir="auto">}<br></div><div dir="auto">```<br></div><div dir="auto"><br></div><div dir="auto">I also verified that `/proc/sys/kernel/unprivileged_userns_clone` is set to `1`.<br></div><div dir="auto">```<br></div><div dir="auto"> >> cat /proc/sys/kernel/unprivileged_userns_clone<br></div><div dir="auto">1<br></div><div dir="auto">```<br></div><div dir="auto"><br></div><div dir="auto">From `/sys/kernel/security/apparmor/profiles` I can see that `bwrap` is set to complain mode, so It should not be restricted in any way.<br></div><div dir="auto">I suspect this may be an issue with my configuration rather than a bug in AppArmor itself. If anyone has insights or suggestions for resolving this, I would greatly appreciate your help.<br></div><div dir="auto">Thank you in advance!<br></div> </body> </html>