Seems like after upgrade from 0.0~git20260728.f8df3f1-1 to
0.0~git20260925.df90211-1 I'm no longer able to use passt with qemu. The
process ends up with error

```
Could not open /proc/49155/uid_map: Permission denied
Couldn't configure user mappings
```

I'm also getting in syslog
```
kernel: audit: type=1400 audit(1790930196.465:152): apparmor="DENIED"
operation="open" class="file" profile="passt" name="/proc/49155/uid_map"
pid=49152 comm="passt.avx2" requested_mask="w" denied_mask="w" fsuid=1000
ouid=1000
```

Looks like the commit 7bf1595c924271b74e924426765fa0b5524e4e57 might have
changed the behavior and now it attempts to write to files the apparamor
profile does allow only reading.

Hi Michal,

Ouch. Thanks for reporting this. It looks like I updated AppArmor files
manually on the setup I used for my local tests and passt kept working
with the change, but I didn't post or release the changes. :(

This needs the AppArmor equivalent of:

https://archives.passt.top/passt-dev/20261002070045.2065145-1-sbrivio@redhat.com/#Z31contrib:selinux:passt.te

...fixing that right now.

Hi Michal,

Ouch. Thanks for reporting this. It looks like I updated AppArmor files
manually on the setup I used for my local tests and passt kept working
with the change, but I didn't post or release the changes. :(

This needs the AppArmor equivalent of:

https://archives.passt.top/passt-dev/20261002070045.2065145-1-sbrivio@redhat.com/#Z31contrib:selinux:passt.te

...fixing that right now.

We believe that the bug you reported is fixed in the latest version of
passt, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1149683@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stefano Brivio <sbrivio@redhat.com> (supplier of updated passt package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sat, 03 Oct 2026 08:55:57 +0200
Source: passt
Architecture: source
Version: 0.0~git20261002.cba3570-1
Distribution: unstable
Urgency: high
Maintainer: Stefano Brivio <sbrivio@redhat.com>
Changed-By: Stefano Brivio <sbrivio@redhat.com>
Closes: 1149683
Changes:
 passt (0.0~git20261002.cba3570-1) unstable; urgency=high
 .
   * New upstream version 0.0~git20261002.cba3570:
     - AppArmor policy fixes for recent changes in user namespace
       detaching procedure for passt(1) (Closes: #1149683)
     - AppArmor fix for recent policy regression, allowing pasta to
       join namespaces mounted under /tmp again, needed by Podman:
https://github.com/podman-container-tools/podman/pull/29867#pullrequestreview-5378330040
     - don't fail if we can't write uid_map and gid_map in the detached
       namespace (also caused by recent changes in handling of user
       namespaces): https://github.com/containers/crun/issues/2283
     - tcp: Don't fast re-transmit if only our FIN is outstanding:
https://bugs.passt.top/show_bug.cgi?id=125
Checksums-Sha1:
 927984cd603042e27fe234832cf21a4c311d1828 1954 passt_0.0~git20261002.cba3570-1.dsc
 3b5e64e5e3b9946dc41ce027b30fe5f8f9d919da 296352 passt_0.0~git20261002.cba3570.orig.tar.xz
 594495ef1cba1bc2ba49f70be1af0e9144c9406e 9028 passt_0.0~git20261002.cba3570-1.debian.tar.xz
 dcff16ebc7554177357b65c24083ce790457d533 7766 passt_0.0~git20261002.cba3570-1_source.buildinfo
Checksums-Sha256:
 6faeec42ce4098caa037f9591620c01ee71af484fc3fea78860c7c335f15409f 1954 passt_0.0~git20261002.cba3570-1.dsc
 aa75616cc43925f0bd6c05bcfbbaecd77397c03d7bd23591b34ef535be5dfcdc 296352 passt_0.0~git20261002.cba3570.orig.tar.xz
 fd2eeb0b32f165babb29659b1f5aae3287680523712350080bf992691b8ea77c 9028 passt_0.0~git20261002.cba3570-1.debian.tar.xz
 dd1333b73466011c528fb552a94100e28f5b735b2d28e1cebc04479d436736ab 7766 passt_0.0~git20261002.cba3570-1_source.buildinfo
Files:
 8a654b5fd6a71a879c587c9338a6e85b 1954 net - passt_0.0~git20261002.cba3570-1.dsc
 0960144553b561ce9ca429798b486926 296352 net - passt_0.0~git20261002.cba3570.orig.tar.xz
 8874b31a48041a60e234f35144d0586e 9028 net - passt_0.0~git20261002.cba3570-1.debian.tar.xz
 fd3a8baec97324d024f6d2c3089ecff5 7766 net - passt_0.0~git20261002.cba3570-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCgAxFiEEBKswzgzj6Yp3tZwepeXCotL+ywsFAmrAqhUTHHNicml2aW9A
cmVkaGF0LmNvbQAKCRCl5cKi0v7LC38SD/9hYodtdcISSDJ8TC8d0y5XBsYxnLK5
bSpB9khNHVBUjSUEooBTNX3SzP4XyAfJREt4cf6YUmbLiFIxgUemCgPT8yg06iTS
leYztgcFgBskzXCOK9+PA2ADEMx6nLkXVxwk3igfyRkuFvgKz2WrwgR1HkpXQfbH
X76Npbm4Vn3JyteFr4byZoe2UnuS9qHS1dspOlK2sZc4hACRCB6jgXzWrLMATbyj
BkBPDGJtQTD3eCzTA1HWbsTRR1l1yEYpcHr8fVVIhBG9dRyJyWcUPfhMMITfVi1a
m+P5kVMC5bR3C9FcW3e+3wGUri8EDD9v2yqOWqZ6GQZsYX7dsnfUIl0q80Rvte76
WAdrHi9zMAY58DW/0lhMRWJ+iW+snY3O0y/2uuqD2UG2TK7ZTnRGNreYPUrU7AZG
duG54xSL8TXbxGbyCVzKJk49xFGDYgL5OvZFWSrFCzgqMcmGTyNOFbLO6SC9cN18
gyAHa83bzcaXSxP5msF6o+oWEc0CJe74hYjhXHo4ahsbwYlqJiknbUJv3qM+2IRN
bzn857Fsdj4Mo3rSo6ncW+Oa9sop9X0yr6rHnWQJAYgn8hyRMv2ffd6ScXSRMuHb
JnSlxC4tMXW3j5qj0Glx+VdCyaVLDPMxgfWtR31QyIu3/og/zk6FbCG3TR51xiN+
WLW+1YP6Twi+dQ==
=O4NN
-----END PGP SIGNATURE-----