Public bug reported:
# Regression: Flatpak bubblewrap fails to write uid_map under AppArmor
on Linux 7.0 HWE kernel
## Summary
After upgrading to the Linux 7.0.0-28 HWE kernel on Linux Mint 22.3
(Ubuntu 24.04 base), all Flatpak applications fail to start when
AppArmor is enabled.
The issue does **not** occur on Linux 6.14 or Linux 6.17 using the same
userspace, Flatpak installation, Bubblewrap version and AppArmor
configuration.
Booting the same kernel with the boot parameter `apparmor=0` immediately
restores Flatpak functionality.
This strongly suggests a regression in the interaction between the Linux
7.0 HWE kernel, AppArmor LSM and Bubblewrap's user namespace setup.
---
# Environment
**Distribution**
Linux Mint 22.3 XFCE
(Ubuntu 24.04 LTS base)
**Kernel versions tested**
| Kernel | Result |
| ----------------- | ------ |
| 6.14.0-37-generic | Works |
| 6.17.0-35-generic | Works |
| 7.0.0-28-generic | Fails |
Current kernel:
```
Linux 7.0.0-28-generic
```
Flatpak:
```
Flatpak 1.16.6
```
Bubblewrap:
```
bubblewrap 0.11.0
```
---
# Regression
This issue appeared immediately after upgrading to Linux 7.0.0-28
through the normal Linux Mint Update Manager.
No Flatpak configuration was changed.
No AppArmor configuration was changed.
Booting back into Linux 6.17 or Linux 6.14 immediately restores correct
Flatpak behavior.
---
# Reproduction
Enable AppArmor normally.
Run any Flatpak application.
Example:
```bash
flatpak run com.github.unrud.VideoDownloader
```
Output:
```
F: Not sharing "/usr/share/fonts" with sandbox: Path "/usr" is reserved by
Flatpak
bwrap: setting up uid map: Permission denied
error: Failed to sync with dbus proxy
```
The failure is 100% reproducible.
---
# Expected Result
Flatpak applications should start normally.
---
# Actual Result
Bubblewrap fails during UID namespace setup.
```
bwrap: setting up uid map: Permission denied
```
---
# Investigation Performed
The following possibilities were tested and ruled out.
## AppArmor profile
Disabled:
* usr.bin.bwrap
* usr.bin.flatpak
No change.
Created an unconfined Bubblewrap profile.
No change.
---
## AppArmor userspace service
Stopping AppArmor:
```bash
sudo systemctl stop apparmor
```
No change.
Flatpak still fails.
---
## AppArmor kernel LSM
Booting with:
```
apparmor=0
```
Flatpak works correctly.
This indicates that disabling the AppArmor kernel LSM resolves the
problem.
---
## User namespaces
User namespaces work correctly.
```
unshare --user --map-root-user id
```
returns
```
uid=0(root) gid=0(root)
```
---
## Bubblewrap
Bubblewrap itself works correctly.
```
bwrap --unshare-user --uid 0 --gid 0 \
--ro-bind / / \
--proc /proc \
--dev /dev \
/bin/sh
```
starts successfully.
Only Flatpak launches fail.
---
## subuid / subgid
Configured correctly.
```
k3:100000:65536
```
---
## Kernel settings
```
kernel.unprivileged_userns_clone = 1
kernel.apparmor_restrict_unprivileged_userns = 0
```
---
## strace
Relevant output:
```
openat(..., "uid_map", O_RDWR|O_CLOEXEC) = -1 EACCES (Permission denied)
```
This corresponds exactly with
```
bwrap: setting up uid map: Permission denied
```
---
## LSM
```
lockdown,capability,landlock,yama,apparmor,ima,evm
```
---
# Why this appears to be a kernel regression
The only variable changed was the kernel.
The same installation behaves as follows:
| Kernel | AppArmor | Result |
| ------ | ---------- | ------ |
| 6.14 | Enabled | OK |
| 6.17 | Enabled | OK |
| 7.0 | Enabled | FAIL |
| 7.0 | apparmor=0 | OK |
No userspace packages, Flatpak configuration, Bubblewrap configuration
or AppArmor profiles were modified during these tests.
The issue therefore appears to have been introduced between Linux 6.17
and Linux 7.0.
---
# Request
Could this be investigated as a possible regression in the interaction
between the Linux 7.0 HWE kernel, AppArmor LSM and Bubblewrap user
namespace handling?
Additional Notes
Multiple users have reported similar behavior after the same AppArmor
update, suggesting this may not be an isolated issue.
Unfortunately, I am unable to provide extensive follow-up testing or
respond to additional technical questions due to limited available time
and limited experience with the bug reporting process. I hope this
report is still useful as a reference for investigating the issue.
** Affects: apparmor (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2161906
Title:
AppArmor 4.0.1 update prevents Flatpak applications from launching on
Linux Mint 22.3 (Ubuntu 24.04 base)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2161906/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
