path: root/contrib/apparmor/usr.bin.pasta

# SPDX-License-Identifier: AGPL-3.0-or-later
#
# PASTA - Pack A Subtle Tap Abstraction
#  for network namespace/tap device mode
#
# contrib/apparmor/usr.bin.pasta - AppArmor profile example/template for pasta
#
# Copyright (c) 2022 Red Hat GmbH
# Author: Stefano Brivio <sbrivio@redhat.com>

abi <abi/3.0>,

include <tunables/global>

/usr/bin/pasta flags=(attach_disconnected) {
  include <abstractions/base>			# Interactive shell
  include <abstractions/nameservice>
  include <abstractions/consoles>
  include <abstractions/bash>
  owner /proc/**/ns/user		r,
  /					r,
  capability sys_ptrace,			# bash
  capability dac_read_search,
  capability dac_override,
  @{etc_ro}/**				r,
  /usr/**				r,
  /lib/**				r,
  owner @{HOME}/**			rw,
  owner /tmp/**				rw,

  /proc/*/net/tcp			r,	# procfs_scan_listen(), util.c
  /proc/*/net/tcp6			r,
  /proc/*/net/udp			r,
  /proc/*/net/udp6			r,

  /dev/net/tun				rw,	# tap_ns_tun(), tap.c

  capability net_admin,				# for network namespace only
  capability setpcap,				# drop_caps(), util.c
  capability sys_admin,				# sandbox(), passt.c

  mount		""	-> "/",			# sandbox(), passt.c
  mount		""	-> "/tmp/",
  pivot_root	"/tmp/" -> "/tmp/",
  umount	"/",

  network netlink raw,				# netlink.c

  network inet stream,				# tcp.c
  network inet6 stream,

  network inet dgram,				# udp.c
  network inet6 dgram,

  network unix stream,				# tap.c

  network unix dgram,				# __openlog(), util.c

  owner /proc/*/gid_map			w,	# pasta_setup_ns()
  owner /proc/*/setgroups		w,
  owner /proc/*/uid_map			w,
  owner /proc/sys/net/ipv4/ping_group_range w,
  /{usr/,}bin/**			mrix,	# spawning shell

  /usr/bin/pasta.avx2			ix,	# arch_avx2_exec(), arch.c
}