Flatpak: bwrap: setting up uid map: Permission denied

[ljnsn]

Is this a new report?

Yes

System Info

Void 6.18.41_1 x86_64 AuthenticAMD notuptodate rrrrmmnFFFFF

Package(s) Affected

flatpak-1.18.0_2

Does a report exist for this bug with the project's home (upstream) and/or another distro?

Same issue as I reported here before.

Expected behaviour

It should be possible to run a flatpak application with flatpak run <pkg>.

Actual behaviour

$ flatpak run com.usebruno.Bruno
bwrap: setting up uid map: Permission denied
error: ldconfig failed, exit status 256

Steps to reproduce

As in #52655, I upgraded which also pulled a new kernel (6.18.41) and rebooted. After reboot, no flatpak application works anymore (and Steam doesn't either, although it's installed with xbps rather than flatpak, probably because it also relies on brwap). As back then, it might not be related to the kernel upgrade at all, but rather AppArmor, perhaps this PR.

[Duncaen]

Disable the flatpak profile with aa-disable flatpak or set apparmor to enforce mode in /etc/default/apparmor.

There is currently a bug in the void apparmor init scripts that forces profiles that are stored as "unconfined" (which flatpak is) into complain mode. That results in flatpak trying to resolve paths for those profiles, which fails in some cases where paths are disconnected from the root filesystem, which is happening in bubblewrap (containers/bubblewrap#769).

This PR will "resolve" the issue, by removing the complain mode from the init script: #61695

[ljnsn]

Thanks! On running aa-disable flatpak, I get this error:

ERROR: Conflicting profiles for php-fpm defined in two files:
- /etc/apparmor.d/usr.bin.php-fpm
- /etc/apparmor.d/php-fpm

I suppose it's related to this #61690, can I just safely delete /etc/apparmor.d/usr.bin.php-fpm?

[Duncaen]

Yes, or just ignore it, I don't think it causes an issue.

[ljnsn]

I did, disabling works and flatpak as well, thanks again! I'm going to leave this open, in case you want to close with the mentioned PR.