aboutgitcodebugslistschat
path: root/contrib/apparmor/abstractions/pasta
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2023-02-27 17:24:40 +0100
committerStefano Brivio <sbrivio@redhat.com>2023-02-27 18:56:32 +0100
commitb1b75bd73a274128fced668002d0af7ece1a0790 (patch)
tree84d4406615af483547ed0662e10f478a99cb9240 /contrib/apparmor/abstractions/pasta
parent0d547a5b0f0bcb3c98f0323adbe4b9fc242ed6a1 (diff)
downloadpasst-b1b75bd73a274128fced668002d0af7ece1a0790.tar
passt-b1b75bd73a274128fced668002d0af7ece1a0790.tar.gz
passt-b1b75bd73a274128fced668002d0af7ece1a0790.tar.bz2
passt-b1b75bd73a274128fced668002d0af7ece1a0790.tar.lz
passt-b1b75bd73a274128fced668002d0af7ece1a0790.tar.xz
passt-b1b75bd73a274128fced668002d0af7ece1a0790.tar.zst
passt-b1b75bd73a274128fced668002d0af7ece1a0790.zip
contrib/apparmor: Split profile into abstractions, use them
One day, libvirt might actually support running passt to provide guest connectivity. Should libvirtd (or virtqemud) start passt, it will need to access socket and PID files in specific locations, and passt needs to accept SIGTERM in case QEMU fails to start after passt is already started. To make this more convenient, split the current profile into two abstractions, for passt and for pasta, so that external programmes can include the bits they need (and especially not include the pasta abstraction if they only need to start passt), plus whatever specific adaptation is needed. For stand-alone usage of passt and pasta, the 'passt' profile simply includes both abstractions, plus rules to create and access PID and capture files in default or reasonable ($HOME) locations. Tested on Debian with libvirt 9.0.0 together with a local fix to start passt as intended, namely libvirt commit c0efdbdb9f66 ("qemu_passt: Avoid double daemonizing passt"). This is an example of how the libvirtd profile (or virtqemud abstraction, or virtqemud profile) can use this: # support for passt network back-end /usr/bin/passt Cx -> passt, profile passt { /usr/bin/passt r, owner @{run}/user/[0-9]*/libvirt/qemu/run/passt/* rw, signal (receive) set=("term") peer=/usr/sbin/libvirtd, signal (receive) set=("term") peer=libvirtd, include if exists <abstractions/passt> } translated: - when executing /usr/bin/passt, switch to the subprofile "passt" (not the "discrete", i.e. stand-alone profile), described below. Scrub the environment (e.g. LD_PRELOAD is dropped) - in the "passt" subprofile: - allow reading the binary - allow read and write access to PID and socket files - make passt accept SIGTERM from /usr/sbin/libvirtd, and libvirtd peer names - include anything else that's needed by passt itself Suggested-by: Andrea Bolognani <abologna@redhat.com> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'contrib/apparmor/abstractions/pasta')
-rw-r--r--contrib/apparmor/abstractions/pasta35
1 files changed, 35 insertions, 0 deletions
diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
new file mode 100644
index 0000000..7d802ac
--- /dev/null
+++ b/contrib/apparmor/abstractions/pasta
@@ -0,0 +1,35 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# PASST - Plug A Simple Socket Transport
+# for qemu/UNIX domain socket mode
+#
+# PASTA - Pack A Subtle Tap Abstraction
+# for network namespace/tap device mode
+#
+# contrib/apparmor/abstractions/pasta - Abstraction for pasta(1)
+#
+# Copyright (c) 2022 Red Hat GmbH
+# Author: Stefano Brivio <sbrivio@redhat.com>
+
+ abi <abi/3.0>,
+
+ include <abstractions/passt>
+
+ @{PROC}/net/tcp r, # procfs_scan_listen(), util.c
+ @{PROC}/net/tcp6 r,
+ @{PROC}/net/udp r,
+ @{PROC}/net/udp6 r,
+
+ @{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c
+
+ @{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(),
+ @{PROC}/[0-9]*/ns/user r, # conf_pasta_ns()
+
+ /dev/net/tun rw, # tap_ns_tun(), tap.c
+
+ owner @{PROC}/@{pid}/gid_map w, # pasta_start_ns(), conf_ugid()
+ owner @{PROC}/@{pid}/setgroups w,
+ owner @{PROC}/@{pid}/uid_map rw,
+
+ owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c
+ /{usr/,}bin/** Ux,