Ubuntu 24.04: AppImage Issues: `cannot write uid_map`

[donpdonp]

I wanted to try isd so I downloaded the app image and chmod 755. It errors immediately. I realize this might be fixed by giving it sudo but I wanted to try it for managing user-mode systemd services first before running a new app with sudo right away.

$ ./isd.AppImage
./isd.AppImage: cannot write uid_map: Operation not permitted
$ ./isd.AppImage --help
./isd.AppImage: cannot write uid_map: Operation not permitted

[welcome]

Thanks for opening your first issue here! 💖

[kainctl]

Nah. There should never be a reason to use sudo, something is broken.
Can you please tell me what distro and systemd version you are using?
Thanks!

[donpdonp]

sure.

$ dpkg -l systemd
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version          Architecture Description
+++-==============-================-============-==============================>
ii  systemd        255.4-1ubuntu8.4 amd64        system and service manager
donp@carbon desktop $ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=24.04
DISTRIB_CODENAME=noble
DISTRIB_DESCRIPTION="Ubuntu 24.04.1 LTS"

[rghvdberg]

same error and specs here

❯ isd 
isd: cannot write uid_map: Operation not permitted

❯ LC_ALL=C dpkg -l systemd
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version          Architecture Description
+++-==============-================-============-=================================
ii  systemd        255.4-1ubuntu8.4 amd64        system and service manager

❯ LC_ALL=C cat /etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=24.04
DISTRIB_CODENAME=noble
DISTRIB_DESCRIPTION="Ubuntu 24.04.1 LTS"

[kainctl]

Ugh, Ubuntu seems to hate AppImages...
Good to know that I packaged it with a "universal" packaging format for Linux and Ubuntu pushes changes without providing an easy option to "whitelist" applications... 🙄

You can see the current workaround here:

• https://github.com/getcursor/cursor/issues/844#issuecomment-2080288303

So in this case it would be:

# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile isd /home/{USER}/Applications/isd*.AppImage flags=(unconfined) {
  userns,
}

Where you are now required to move it to the ~/Applications directory (create it if it doesn't exist).

I believe this is related to this blog post from Canonical:

• https://discourse.ubuntu.com/t/spec-unprivileged-user-namespace-restrictions-via-apparmor-in-ubuntu-23-10/37626

And the upstream tracker is here:

• https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2046844

Giving me hope that there might be some better integration from Ubuntu.

Why can't there be an easy way to package things for Linux?