diff --git a/bitbake/bin/bitbake-worker b/bitbake/bin/bitbake-worker
index e8073f2ac3..0a042fdc7c 100755
--- a/bitbake/bin/bitbake-worker
+++ b/bitbake/bin/bitbake-worker
@@ -272,12 +272,21 @@ def fork_off_task(cfg, data, databuilder, workerdata, extraconfigdata, runtask):
 
                 bb.utils.set_process_name("%s:%s" % (the_data.getVar("PN"), taskname.replace("do_", "")))
 
+                def skip_disable_network(taskname, uid):
+                    if not bb.utils.is_local_uid(uid):
+                        logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid))
+                        return True
+                    if os.path.exists("/proc/sys/kernel/apparmor_restrict_unprivileged_userns"):
+                        with open("/proc/sys/kernel/apparmor_restrict_unprivileged_userns") as f:
+                            if f.readline().strip() == "1":
+                                logger.debug("Skipping disable network since sys.kernel.apparmor_restrict_unprivileged_userns is 1")
+                                return True
+                    return False
+
                 if not bb.utils.to_boolean(the_data.getVarFlag(taskname, 'network')):
-                    if bb.utils.is_local_uid(uid):
+                    if not skip_disable_network(taskname, uid):
                         logger.debug("Attempting to disable network for %s" % taskname)
                         bb.utils.disable_network(uid, gid)
-                    else:
-                        logger.debug("Skipping disable network for %s since %s is not a local uid." % (taskname, uid))
 
                 # exported_vars() returns a generator which *cannot* be passed to os.environ.update() 
                 # successfully. We also need to unset anything from the environment which shouldn't be there