From e0fae308fc6ded0636a4f789727c9759f53d268d Mon Sep 17 00:00:00 2001 From: Duncan Overbruck Date: Wed, 29 Jul 2026 18:47:05 +0200 Subject: [PATCH] bubblewrap: reopen proc_fd from inside namespace Reopen the /proc file descriptor from inside the namespace to avoid AppArmor complaining about the path being disconnected. Signed-off-by: Duncan Overbruck --- bubblewrap.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/bubblewrap.c b/bubblewrap.c index 3b9719c4..6cc302c2 100644 --- a/bubblewrap.c +++ b/bubblewrap.c @@ -2883,6 +2883,13 @@ main (int argc, return monitor_child (event_fd, pid, setup_finished_pipe[0]); } + /* Reopen the /proc file descriptor from inside the namespace to avoid + * AppArmor complaining about the path being disconnected. */ + close (proc_fd); + proc_fd = TEMP_FAILURE_RETRY (open ("/proc", O_PATH)); + if (proc_fd == -1) + die_with_error ("Can't open /proc"); + if (opt_pidns_fd != -1) { if (setns (opt_pidns_fd, CLONE_NEWPID) != 0)