On Sat, Oct 03, 2026 at 12:22:25AM +0200, Stefano Brivio wrote:
With passt commit 7bf1595c9242 ("isolation: Don't create our userns as nobody"), instead of a direct unshare() to detach the isolating user namespace, we now have a two-step process where we join the namespace by opening its procfs entry.
After detaching the isolated namespace, AppArmor considers its procfs entry a disconnected object, so we don't have a way to refer to it unless we use the attach_disconnected flag in the relevant profile.
For stand-alone passt(1) usage, this is taken care of in passt commit 032f082ffad0 ("apparmor: Fixes for new user namespace detaching procedure"), but libvirt (as non-root) runs passt as a separate subprofile, and that's where we need to add that flag.
Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149683 Signed-off-by: Stefano Brivio <sbrivio@redhat.com> --- src/security/apparmor/libvirt-qemu | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Fix Reviewed-by: Andrea Bolognani <abologna@redhat.com> and pushed. Thanks! -- Andrea Bolognani / Red Hat / Virtualization