Arch Linux

0x00007C00

Member

Registered: 2026-07-01

Posts: 5

[SOLVED]Steam – "bwrap: setting up uid map: Permission denied"

Hello,
I'm facing a persistent issue with the official steam package from multilib.

steam-runtime-check-requirements: W: Child process exited with code 1: bwrap: setting up uid map: Permission denied
Error: Steam now requires user namespaces to be enabled.

Environment:

Official steam package
Kernel with user namespaces enabled
AppArmor enabled (LSM active)

What already works:

sysctl kernel.unprivileged_userns_clone = 1
user.max_user_namespaces is high
/etc/subuid and /etc/subgid have correct entries for my user
/usr/bin/newuidmap and /usr/bin/newgidmap are setuid root
Basic tests succeed:
unshare --user --pid echo OK
unshare -U -r id
System bwrap --unshare-user ... works

Full wipe of ~/.local/share/Steam + reinstall of the steam package => same error
Tested from a clean TTY => same error

What I tried:

Disabled the AppArmor profile unprivileged_userns
Created AppArmor profiles allowing userns for both /usr/bin/bwrap and Steam’s srt-bwrap
Setuid on system bwrap => no change
Setuid + root ownership on Steam’s srt-bwrap => rejected with:
bwrap: setuid use of bubblewrap is not supported in this build

Important observation:
Steam uses its own binary:
~/.local/share/Steam/ubuntu12_32/steam-runtime/usr/libexec/steam-runtime-tools-0/srt-bwrap
When I run steam-runtime-check-requirements under strace, the openat + write to uid_map/gid_map succeed. The failure only occurs when launched from the full Steam process.
Has anyone seen this specific combination (official package + srt-bwrap + uid_map permission denied while all low-level tests pass)?

Any idea what else could still block the uid map setup in the Steam runtime context?
Thanks.

Last edited by 0x00007C00 (2026-08-05 17:42:21)

0x00007C00

Member

Registered: 2026-07-01

Posts: 5

Re: [SOLVED]Steam – "bwrap: setting up uid map: Permission denied"

Finally, I found the solution. But what's strange is that I already tried this and it didn't work in the first time:

The issue was caused by the AppArmor profile for Steam.
Even when the profile was set to complain mode, and even after putting unprivileged_userns in complain mode, Steam’s srt-bwrap was still unable to set up the uid/gid map (Permission denied).
Key diagnostic step:
$ sudo aa-disable /etc/apparmor.d/steam

After disabling the Steam AppArmor profile entirely, Steam launched normally without any error.
Conclusion:
The stock AppArmor profile for Steam is currently incompatible with the recent Steam Runtime (especially srt-bwrap + user namespaces).
All low-level user namespace requirements were already correctly configured (kernel.unprivileged_userns_clone=1, subuid/subgid, setuid newuidmap/newgidmap, etc.). The only blocker was the AppArmor profile itself.

seth

Member

From: Won't reply 2 private help req

Registered: 2012-09-03

Posts: 77,527

Re: [SOLVED]Steam – "bwrap: setting up uid map: Permission denied"

https://archlinux.org/packages/extra/x8 … wrap-suid/ ?

Please always remember to mark resolved threads by editing your initial posts subject - so others will know that there's no task left, but maybe a solution to find.
Thanks.

---

How to upload text · How to boot w/o GUI · Disable Windows Fast-Start! · Fix your xinitrc