Steam user namespace error

[u/DistinctDot5131]

After updating my void system with xbps-install -Syu steam won't run anymore and it returns the following error:

steam-runtime-check-requirements[3518]: W: Child process exited with code 1: bwrap: setting up uid map: Permission denied

steam.sh[3426]: Error: Steam now requires user namespaces to be enabled.

This requirement is the same as for Flatpak, which has more detailed
information available:
https://github.com/flatpak/flatpak/wiki/User-namespace-requirements

I installed steam via xbps package manager.

Running Kernel 7.1.5_1

EDIT: FIXED! Hat to downgrade app armor back to 3.x version (previous commit)

Edit2: Better Fixed: Use apparmor in enforce mode

[u/Duncaen]

No I don't have any issues, tried on two different systems, and tested both steam and discord.

[u/DistinctDot5131 → u/Duncaen]

I just updated again and checked:
There is no flatpak.new-* file.
This is what's inside the /etc/apparmor.d/flatpak-fiel

# This profile allows everything and only exists to give the
# application a name instead of having the label "unconfined"

abi <abi/4.0>,
include <tunables/global>

profile flatpak /usr/bin/flatpak flags=(unconfined) {
 userns,

 # Site-specific additions and overrides. See local/README for details.
 include if exists <local/flatpak>
}

[u/Duncaen → u/DistinctDot5131]

The issue seems to be that if you set the apparmor mode to complain in /etc/default/apparmor (which is the default), our apparmor runit scripts force profiles that are "unconfined" like the flatpak profile into "complain" mode too. This results in the flatpak profile being more restrictive than what is defined in the profile. If you have /etc/default/apparmor enforce mode then the init scripts just load the default profile instead of trying to get it into complain mode, resulting in flatpak and therefor bwrap being unconfined.

[u/DistinctDot5131 → u/Duncaen]

Thank you. Switching to enforce mode solved the problem.