passt/contrib/selinux, branch 2023_06_27.289301b

passt: Relicense to GPL 2.0, or any later version

2023-04-06T16:00:33+00:00

In practical terms, passt doesn't benefit from the additional
protection offered by the AGPL over the GPL, because it's not
suitable to be executed over a computer network.

Further, restricting the distribution under the version 3 of the GPL
wouldn't provide any practical advantage either, as long as the passt
codebase is concerned, and might cause unnecessary compatibility
dilemmas.

Change licensing terms to the GNU General Public License Version 2,
or any later version, with written permission from all current and
past contributors, namely: myself, David Gibson, Laine Stump, Andrea
Bolognani, Paul Holzinger, Richard W.M. Jones, Chris Kuhn, Florian
Weimer, Giuseppe Scrivano, Stefan Hajnoczi, and Vasiliy Ulyanov.

Signed-off-by: Stefano Brivio

selinux: Drop useless interface file for pasta

2023-03-29T11:48:12+00:00

This was meant to be an example, but I managed to add syntax errors
to it. Drop it altogether.

Reported-by: Carl G. 
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2182145
Signed-off-by: Stefano Brivio

contrib/selinux: Split interfaces into smaller bits

2023-03-10T19:01:41+00:00

...to fit accepted Fedora practices.

Link: https://github.com/fedora-selinux/selinux-policy/pull/1613
Signed-off-by: Stefano Brivio

contrib/selinux: Drop unused passt_read_data() interface

2023-03-10T19:01:41+00:00

Signed-off-by: Stefano Brivio

contrib/selinux: Drop "example" from headers: this is the actual policy

2023-03-10T19:01:41+00:00

Signed-off-by: Stefano Brivio

contrib/selinux: Let interface users set paths for log, PID, socket files

2023-03-08T23:36:08+00:00

Even libvirt itself will configure passt to write log, PID and socket
files to different locations depending on whether the domain is
started as root (/var/log/libvirt/...) or as a regular user
(/var/log//libvirt/...), and user_tmp_t would only cover the
latter.

Create interfaces for log and PID files, so that callers can specify
different file contexts for those, and modify the interface for the
UNIX socket file to allow different paths as well.

Signed-off-by: Stefano Brivio 
Tested-by: Laine Stump 
Reviewed-by: Laine Stump

contrib/selinux: Allow binding and connecting to all UDP and TCP ports

2023-03-08T23:36:08+00:00

Laine reports that with a simple:

      
        
      

in libvirt's domain XML, passt won't start as it fails to bind
arbitrary ports. That was actually the intention behind passt_port_t:
the user or system administrator should have explicitly configured
allowed ports on a given machine. But it's probably not realistic, so
just allow any port to be bound and forwarded.

Also fix up some missing operations on sockets.

Reported-by: Laine Stump 
Signed-off-by: Stefano Brivio 
Tested-by: Laine Stump 
Reviewed-by: Laine Stump

contrib/selinux: Let passt write to stdout and stderr when it starts

2023-03-08T23:36:08+00:00

Otherwise, it's unusable as stand-alone tool, or in foreground mode,
and it's also impossible to get output from --help or --version,
because for SELinux it's just a daemon.

Signed-off-by: Stefano Brivio 
Tested-by: Laine Stump 
Reviewed-by: Laine Stump

contrib/selinux: Drop duplicate init_daemon_domain() rule

2023-03-08T23:36:08+00:00

Signed-off-by: Stefano Brivio 
Tested-by: Laine Stump 
Reviewed-by: Laine Stump

selinux/passt.te: Allow setting socket option on routing netlink socket

2023-02-21T18:12:37+00:00

Signed-off-by: Stefano Brivio