diff options
| author | Sevinj Aghayeva <sevinj.aghayeva@gmail.com> | 2026-09-07 14:39:37 -0700 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2026-09-08 16:15:39 +0200 |
| commit | 3a890a678fbeb930d41274c0258c1905f43cc068 (patch) | |
| tree | 04d97259dd7fe45533bcfc9b1c0784c0f72ebddf | |
| parent | de8b085b3bb18ebfbb2fd2409fece8fe2d8af5e1 (diff) | |
| download | passt-3a890a678fbeb930d41274c0258c1905f43cc068.tar passt-3a890a678fbeb930d41274c0258c1905f43cc068.tar.gz passt-3a890a678fbeb930d41274c0258c1905f43cc068.tar.bz2 passt-3a890a678fbeb930d41274c0258c1905f43cc068.tar.lz passt-3a890a678fbeb930d41274c0258c1905f43cc068.tar.xz passt-3a890a678fbeb930d41274c0258c1905f43cc068.tar.zst passt-3a890a678fbeb930d41274c0258c1905f43cc068.zip | |
Since Linux 5.12, writing a mapping from UID 0 to /proc/self/uid_map
requires CAP_SETFCAP. isolation.c already retains this capability for
the case where pasta spawns a child from a non-init user namespace,
but the AppArmor profile doesn't grant it, so the write is denied
whenever the profile is enforced.
Add setfcap to the AppArmor abstraction to match what isolation.c
expects.
Link: https://bugs.passt.top/show_bug.cgi?id=172
Signed-off-by: Sevinj Aghayeva <sevinj.aghayeva@gmail.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
| -rw-r--r-- | contrib/apparmor/abstractions/passt | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index 85bd1ee..f4570c1 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -24,6 +24,7 @@ capability setpcap, capability net_admin, capability sys_ptrace, + capability setfcap, userns, / r, # isolate_prefork(), isolation.c |