diff options
| author | Paul Holzinger <pholzing@redhat.com> | 2024-05-13 19:41:55 +0200 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2024-05-13 23:02:18 +0200 |
| commit | 6cdc9fd51bf65a811e0856056193d7bb076c4b0f (patch) | |
| tree | f95e13ea5a40adce68254c387f605d511174168f | |
| parent | 80f7ff29964f16a9eef107c6c1d0b2c0554deab0 (diff) | |
| download | passt-6cdc9fd51bf65a811e0856056193d7bb076c4b0f.tar passt-6cdc9fd51bf65a811e0856056193d7bb076c4b0f.tar.gz passt-6cdc9fd51bf65a811e0856056193d7bb076c4b0f.tar.bz2 passt-6cdc9fd51bf65a811e0856056193d7bb076c4b0f.tar.lz passt-6cdc9fd51bf65a811e0856056193d7bb076c4b0f.tar.xz passt-6cdc9fd51bf65a811e0856056193d7bb076c4b0f.tar.zst passt-6cdc9fd51bf65a811e0856056193d7bb076c4b0f.zip | |
apparmor: allow netns paths on /tmp
For some unknown reason "owner" makes it impossible to open bind mounted
netns references as apparmor denies it. In the kernel denied log entry
we see ouid=0 but it is not clear why that is as the actual file is
owned by the real (rootless) user id.
In abstractions/pasta there is already `@{run}/user/@{uid}/**` without
owner set for the same reason as this path contains the netns path by
default when running under Podman.
Fixes: 72884484b00d ("apparmor: allow read access on /tmp for pasta")
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
| -rw-r--r-- | contrib/apparmor/usr.bin.pasta | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 2a4d28c..bdfeb71 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -19,7 +19,7 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include <abstractions/pasta> # Alternatively: include <abstractions/user-tmp> - owner /tmp/** rw, # tap_sock_unix_init(), pcap(), + /tmp/** rw, # tap_sock_unix_init(), pcap(), # write_pidfile(), # logfile_init(), # pasta_open_ns() |