aboutgitcodebugslistschat
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2024-04-03 20:12:47 +0200
committerStefano Brivio <sbrivio@redhat.com>2024-04-05 12:12:26 +0200
commit100919ce745b987f57c8eb24e55e576c530d2be5 (patch)
treef10bf04fd8247789d13b1f8a11181341c270953f
parentdc7b7f28b7328e17a49022368b6eb543ef1cc33a (diff)
downloadpasst-100919ce745b987f57c8eb24e55e576c530d2be5.tar
passt-100919ce745b987f57c8eb24e55e576c530d2be5.tar.gz
passt-100919ce745b987f57c8eb24e55e576c530d2be5.tar.bz2
passt-100919ce745b987f57c8eb24e55e576c530d2be5.tar.lz
passt-100919ce745b987f57c8eb24e55e576c530d2be5.tar.xz
passt-100919ce745b987f57c8eb24e55e576c530d2be5.tar.zst
passt-100919ce745b987f57c8eb24e55e576c530d2be5.zip
apparmor: Expand scope of @{run}/user access, allow writing PID files too
With Podman's custom networks, pasta will typically need to open the target network namespace at /run/user/<UID>/containers/networks: grant access to anything under /run/user/<UID> instead of limiting it to some subpath. Note that in this case, Podman will need pasta to write out a PID file, so we need write access, for similar locations, too. Reported-by: Jörg Sonnenberger <joerg@bec.de> Link: https://github.com/containers/buildah/issues/5440 Link: https://bugzilla.suse.com/show_bug.cgi?id=1221840 Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
-rw-r--r--contrib/apparmor/abstractions/pasta2
1 files changed, 1 insertions, 1 deletions
diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index a890391..060caab 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -27,7 +27,7 @@
@{PROC}/@{pid}/net/udp r,
@{PROC}/@{pid}/net/udp6 r,
- @{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c
+ @{run}/user/@{uid}/** rw, # pasta_open_ns(), main()
@{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(),
@{PROC}/[0-9]*/ns/user r, # conf_pasta_ns()