diff options
| author | Stefano Brivio <sbrivio@redhat.com> | 2026-09-25 22:38:51 +0200 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2026-09-25 22:38:51 +0200 |
| commit | f2683d14802d1430b383f48eb3105f11361edda1 (patch) | |
| tree | 36a5fc3d021ecf5571679fb3e1014246177f4bcc | |
| parent | 588b545dae741bec6fd7622a33c7852c06d72a59 (diff) | |
| download | passt-f2683d14802d1430b383f48eb3105f11361edda1.tar passt-f2683d14802d1430b383f48eb3105f11361edda1.tar.gz passt-f2683d14802d1430b383f48eb3105f11361edda1.tar.bz2 passt-f2683d14802d1430b383f48eb3105f11361edda1.tar.lz passt-f2683d14802d1430b383f48eb3105f11361edda1.tar.xz passt-f2683d14802d1430b383f48eb3105f11361edda1.tar.zst passt-f2683d14802d1430b383f48eb3105f11361edda1.zip | |
apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only
Podman overrides TMPDIR to /var/tmp, and an upcoming change in the
requires pasta to write its PID file to TMPDIR.
To support this in the AppArmor policy, we need to loosen the existing
rule restricting file writes to /tmp/ and subpaths in order to include
common alternative paths for TMPDIR: the user-tmp abstraction does
exactly this.
Reported-by: Giuseppe Scrivano <gscrivan@redhat.com>
Link: https://github.com/podman-container-tools/container-libs/pull/1207
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
| -rw-r--r-- | contrib/apparmor/usr.bin.passt | 3 | ||||
| -rw-r--r-- | contrib/apparmor/usr.bin.pasta | 3 |
2 files changed, 2 insertions, 4 deletions
diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index c123a86..da49e37 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -18,8 +18,7 @@ include <tunables/global> profile passt /usr/bin/passt{,.avx2} { include <abstractions/passt> - # Alternatively: include <abstractions/user-tmp> - owner /tmp/** w, # tap_sock_unix_open(), + include <abstractions/user-tmp> # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 56b5024..32dfad9 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -18,8 +18,7 @@ include <tunables/global> profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include <abstractions/pasta> - # Alternatively: include <abstractions/user-tmp> - /tmp/** rw, # tap_sock_unix_open(), + include <abstractions/user-tmp> # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), |