From 43b510e77f987f586c09ea19feb7e1351bff6d4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Sun, 23 Aug 2026 22:03:31 +0200
Subject: [PATCH] fix(podman): restore newuidmap/newgidmap file caps for
 rootless namespaces

pacman strips file capabilities, leaving rootless podman unable to set up
user namespaces (rc 125). Re-apply cap_setuid/cap_setgid on Arch.
---
 roles/podman/tasks/main.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/roles/podman/tasks/main.yml b/roles/podman/tasks/main.yml
index 0fbb696..49a194f 100644
--- a/roles/podman/tasks/main.yml
+++ b/roles/podman/tasks/main.yml
@@ -36,6 +36,20 @@
       After reboot, rootless Podman containers will have better network performance.
   when: not kernel_modules.stat.exists or (tun_loaded is defined and tun_loaded is failed)
 
+- name: Ensure newuidmap has setuid file capability
+  community.general.capabilities:
+    path: /usr/bin/newuidmap
+    capability: cap_setuid+ep
+    state: present
+  when: ansible_facts['os_family'] == 'Archlinux'
+
+- name: Ensure newgidmap has setgid file capability
+  community.general.capabilities:
+    path: /usr/bin/newgidmap
+    capability: cap_setgid+ep
+    state: present
+  when: ansible_facts['os_family'] == 'Archlinux'
+
 - name: Enable Podman service
   ansible.builtin.systemd:
     name: podman.service