Permission denied when trying to run Podman Desktop on Ubuntu 24.04

[odockal]

Bug description

I am getting permission denied when I try to run podman desktop on ubuntu 24.04. I tried flatpak and running the binary, nothing works. Same for yarn watch.

yarn watch
...
9:33:19 AM [main] [11457:0520/093319.758984:FATAL:credentials.cc(127)] Check failed: . : Permission denied (13)
Done in 40.67s.

Run from locally built binary (or downloaded from tar archive):

$ ./podman-desktop 
[11530:0520/093828.734261:FATAL:credentials.cc(127)] Check failed: . : Permission denied (13)
Trace/breakpoint trap (core dumped)

Running from flatpak:

$ flatpak run io.podman_desktop.PodmanDesktop 

Note that the directories 

'/var/lib/flatpak/exports/share'
'/home/ubuntu/.local/share/flatpak/exports/share'

are not in the search path set by the XDG_DATA_DIRS environment variable, so
applications installed by Flatpak may not appear on your desktop until the
session is restarted.

bwrap: Creating new namespace failed: Permission denied
error: ldconfig failed, exit status 256

Operating system

Ubuntu 24.04

Installation Method

Installer from website/GitHub releases

Version

1.10.2

Steps to reproduce

No response

Relevant log output

No response

Additional context

I am on VM on my fedora using latest Ubuntu 24.04 iso image.

[odockal]

Seems like this is the new feature that break podman desktop on ubuntu 24.04: https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890

[odockal]

dmesg program shows some audit problems:

[  452.099933] audit: type=1400 audit(1716288123.267:88): apparmor="DENIED" operation="userns_create" class="namespace" info="Userns create restricted - failed to find unprivileged_userns profile" error=-13 profile="unconfined" pid=5873 comm="podman-desktop" requested="userns_create" denied="userns_create" target="unprivileged_userns"
[  452.099958] traps: podman-desktop[5873] trap int3 ip:63c7a47e1a8a sp:7ffef7d04220 error:0 in podman-desktop[63c7a0ad6000+8406000]

Leading to a workaround that will unblock running apps in unprivileged namespace: sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0 which let podman desktop to start in my local ubuntu VM.

[odockal]

I have run a testing workflow: https://github.com/odockal/podman-desktop-extension-bootc/actions/runs/9173447991/job/25222156937 and tests have passed. Seems like the workaround is good enough.

[odockal]

Fixed by: #7266