Flatpak: bwrap: setting up uid map: Permission denied

[ljnsn]

Is this a new report?

Yes

System Info

Void 6.6.56_2 x86_64 AuthenticAMD uptodate rrrrmmnFFFFFFF

Package(s) Affected

flatpak-1.15.10_2

Does a report exist for this bug with the project's home (upstream) and/or another distro?

No response

Expected behaviour

It should be possible to run a flatpak application with flatpak run <pkg>.

Actual behaviour

$ flatpak run md.obsidian.Obsidian 
bwrap: setting up uid map: Permission denied
error: ldconfig failed, exit status 256

The same happens for any other flatpak application.

Steps to reproduce

I ran xbps-install -Su which installed a new kernel 6.6.56_2. I then rebooted and since get this error when trying to run any flatpak application. Before the update, there were no issues with flatpak.

[classabbyamp]

are you using apparmor?

[ljnsn]

Yes, nothing changed there though afaik.

I also just found this which seems related? Maybe some kernel settings have changed?

[ljnsn]

I just booted with two older kernels (6.6.54_1, 6.6.52_1) and it's the same there, so it might not be related to the kernel update.

[classabbyamp]

apparmor was updated recently, try disabling it

[ljnsn]

Yep, that was it, thanks a lot! Any steps I can/should take on my side to get flatpak to work with apparmor enabled? Or is this going to be solved by a package update?

[classabbyamp]

it probably needs an apparmor profile or something

[ljnsn]

I'm happy to help provide one, but not sure where to start. Why did it work before the update?

FWIW, I do have this flatpak profile:

$ bat -p /etc/apparmor.d/flatpak
# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile flatpak /usr/bin/flatpak flags=(unconfined) {
  userns,

  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/flatpak>
}

Which actually seems to allow everything, so not sure why it's complaining now.

[classabbyamp]

reverting the apparmor update as it was not a stable release