passt/contrib, branch 2023_03_09.7c7625d

contrib: Drop libvirt out-of-tree patch, integration mostly works in 9.1.0

2023-03-09T02:44:21+00:00

...and in any case, this patch doesn't offer any advantage over the
current upstream integration.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

contrib: Drop QEMU out-of-tree patches

2023-03-09T02:44:21+00:00

Native support was introduced with commit 13c6be96618c, QEMU 7.2.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

contrib: Drop Podman out-of-tree patch, integration is upstream now

2023-03-09T02:44:21+00:00

See https://github.com/containers/podman/pull/16141, shipped in
Podman 4.4.

Signed-off-by: Stefano Brivio 
Reviewed-by: David Gibson

contrib/selinux: Let interface users set paths for log, PID, socket files

2023-03-08T23:36:08+00:00

Even libvirt itself will configure passt to write log, PID and socket
files to different locations depending on whether the domain is
started as root (/var/log/libvirt/...) or as a regular user
(/var/log//libvirt/...), and user_tmp_t would only cover the
latter.

Create interfaces for log and PID files, so that callers can specify
different file contexts for those, and modify the interface for the
UNIX socket file to allow different paths as well.

Signed-off-by: Stefano Brivio 
Tested-by: Laine Stump 
Reviewed-by: Laine Stump

contrib/selinux: Allow binding and connecting to all UDP and TCP ports

2023-03-08T23:36:08+00:00

Laine reports that with a simple:

      
        
      

in libvirt's domain XML, passt won't start as it fails to bind
arbitrary ports. That was actually the intention behind passt_port_t:
the user or system administrator should have explicitly configured
allowed ports on a given machine. But it's probably not realistic, so
just allow any port to be bound and forwarded.

Also fix up some missing operations on sockets.

Reported-by: Laine Stump 
Signed-off-by: Stefano Brivio 
Tested-by: Laine Stump 
Reviewed-by: Laine Stump

contrib/selinux: Let passt write to stdout and stderr when it starts

2023-03-08T23:36:08+00:00

Otherwise, it's unusable as stand-alone tool, or in foreground mode,
and it's also impossible to get output from --help or --version,
because for SELinux it's just a daemon.

Signed-off-by: Stefano Brivio 
Tested-by: Laine Stump 
Reviewed-by: Laine Stump

contrib/selinux: Drop duplicate init_daemon_domain() rule

2023-03-08T23:36:08+00:00

Signed-off-by: Stefano Brivio 
Tested-by: Laine Stump 
Reviewed-by: Laine Stump

contrib/apparmor: Split profile into abstractions, use them

2023-02-27T17:56:32+00:00

One day, libvirt might actually support running passt to provide
guest connectivity. Should libvirtd (or virtqemud) start passt, it
will need to access socket and PID files in specific locations, and
passt needs to accept SIGTERM in case QEMU fails to start after passt
is already started.

To make this more convenient, split the current profile into two
abstractions, for passt and for pasta, so that external programmes
can include the bits they need (and especially not include the pasta
abstraction if they only need to start passt), plus whatever specific
adaptation is needed.

For stand-alone usage of passt and pasta, the 'passt' profile simply
includes both abstractions, plus rules to create and access PID and
capture files in default or reasonable ($HOME) locations.

Tested on Debian with libvirt 9.0.0 together with a local fix to start
passt as intended, namely libvirt commit c0efdbdb9f66 ("qemu_passt:
Avoid double daemonizing passt"). This is an example of how the
libvirtd profile (or virtqemud abstraction, or virtqemud profile) can
use this:

  # support for passt network back-end
  /usr/bin/passt Cx -> passt,
  profile passt {
    /usr/bin/passt r,

    owner @{run}/user/[0-9]*/libvirt/qemu/run/passt/* rw,
    signal (receive) set=("term") peer=/usr/sbin/libvirtd,
    signal (receive) set=("term") peer=libvirtd,

    include if exists 
  }

translated:

- when executing /usr/bin/passt, switch to the subprofile "passt"
  (not the "discrete", i.e. stand-alone profile), described below.
  Scrub the environment (e.g. LD_PRELOAD is dropped)

- in the "passt" subprofile:

  - allow reading the binary

  - allow read and write access to PID and socket files

  - make passt accept SIGTERM from /usr/sbin/libvirtd, and
    libvirtd peer names

  - include anything else that's needed by passt itself

Suggested-by: Andrea Bolognani 
Signed-off-by: Stefano Brivio

selinux/passt.te: Allow setting socket option on routing netlink socket

2023-02-21T18:12:37+00:00

Signed-off-by: Stefano Brivio

selinux/passt.te: Allow /etc/resolv.conf symlinks to be followed

2023-02-21T18:12:37+00:00

Signed-off-by: Stefano Brivio