passt, branch 2026_09_25.df90211

udp: Add missing @now parameter doc to udp_flow_from_tap()

2026-09-25T21:03:06+00:00

udp_flow_from_tap() takes a @now parameter but its doc comment
omits it.

Signed-off-by: Laurent Vivier 
Signed-off-by: Stefano Brivio

apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only

2026-09-25T20:38:51+00:00

Podman overrides TMPDIR to /var/tmp, and an upcoming change in the
requires pasta to write its PID file to TMPDIR.

To support this in the AppArmor policy, we need to loosen the existing
rule restricting file writes to /tmp/ and subpaths in order to include
common alternative paths for TMPDIR: the user-tmp abstraction does
exactly this.

Reported-by: Giuseppe Scrivano 
Link: https://github.com/podman-container-tools/container-libs/pull/1207
Signed-off-by: Stefano Brivio

pasta: Add --no-pidns to keep spawned command in caller's PID namespace

2026-09-16T08:54:02+00:00

This is to allow running pasta inside a container without unmasking
/proc for the whole container (Docker's --security-opt
systempaths=unconfined, Podman's --security-opt unmask=ALL), which is
undesirable as it exposes /proc/sysrq-trigger and other masked paths.

In spawn mode, pasta clones the command with CLONE_NEWPID and mounts a
new procfs instance on /proc, so that it matches the new PID namespace.

Mounting procfs in a new user namespace requires a fully visible,
unobstructed procfs. Container runtimes deliberately obstruct /proc
(Docker, for example, masks /proc/kcore and friends and mounts
/proc/sys read-only), so the mount is refused:

  Couldn't mount /proc: Operation not permitted

We only warn and continue, leaving the command in a new PID namespace
while the visible /proc still numbers processes in the outer one.
Anything resolving its own PID through /proc then fails, for example
bubblewrap:

  bwrap: open /proc/22/ns/ns failed: No such file or directory

Add a --no-pidns option: skip CLONE_NEWPID for the spawned command and
don't mount /proc, which is then not needed. User, network, mount, UTS
and IPC namespaces, --config-net and port forwarding are unaffected.
The option is rejected together with PID or --netns, as it only makes
sense when we spawn the command ourselves.

Add a test checking that, by default, the command runs in a new PID
namespace, and that --no-pidns keeps it in the caller's one.

Signed-off-by: Christian Korneck 
Signed-off-by: Stefano Brivio

contrib/apparmor: add missing setfcap capability

2026-09-08T14:15:39+00:00

Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map
requires CAP_SETFCAP. isolation.c already retains this capability for
the case where pasta spawns a child from a non-init user namespace,
but the AppArmor profile doesn't grant it, so the write is denied
whenever the profile is enforced.

Add setfcap to the AppArmor abstraction to match what isolation.c
expects.

Link: https://bugs.passt.top/show_bug.cgi?id=172
Signed-off-by: Sevinj Aghayeva 
Signed-off-by: Stefano Brivio

vhost_user: Reset vq enable flag in vu_cleanup()

2026-09-08T14:15:37+00:00

vu_cleanup() resets most virtqueue state (started, notification,
file descriptors) but does not reset the enable flag.  After a
QEMU disconnect and reconnect, the stale enable flag causes
vu_set_vring_enable_exec() to hit its early return check
(vq->enable == enable).

Reset vq->enable to false in vu_cleanup() alongside the other
virtqueue state.

Signed-off-by: Laurent Vivier 
Reviewed-by: David Gibson 
Signed-off-by: Stefano Brivio

Add Zed editor settings

2026-09-08T14:11:30+00:00

I've been playing around with the Zed editor again.  Its default tab and
indent settings are a bit weird, and don't match passt's code style.  Add
a project config file to improve that.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

util, pasta: Remove some unneeded #includes

2026-09-08T14:11:28+00:00

Presumably these mattered at some point in the past, but no longer.  Found
by clangd as invoked by Zed editor.  Not sure why direct clang-tidy runs
didn't spot these.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

util: Add missing O_CLOEXEC for !HAS_GETRANDOM path

2026-09-08T14:11:26+00:00

It rarely matters, since we usually have getrandom(), but in case we don't
our open() of /dev/random was missing O_CLOEXEC, which can cause clang
warnings.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

util: Eliminate a stray trailing whitespace

2026-09-08T14:11:24+00:00

We generally avoid trailing whitespace, but one slipped in.  Fix it.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio

clangd: Add _GNU_SOURCE to default clangd options

2026-09-08T14:11:21+00:00

We always insert -D_GNU_SOURCE and -D_XOPEN_SOURCE=700 when compiling from
the Makefile, and we rely on it.  Without these listed in .clangd, clangd
will generate numerous spurious warnings.

Signed-off-by: David Gibson 
Signed-off-by: Stefano Brivio