aboutgitcodebugslistschat
path: root/contrib/apparmor/abstractions
diff options
context:
space:
mode:
authorDanish Prakash <danish.prakash@suse.com>2024-04-03 20:25:23 +0200
committerStefano Brivio <sbrivio@redhat.com>2024-04-05 12:12:26 +0200
commit88c2f08eba342d52bf722533d270f0c84045d41c (patch)
treee2e202cf1e1fb427e7595e1f017f020f777d7501 /contrib/apparmor/abstractions
parent100919ce745b987f57c8eb24e55e576c530d2be5 (diff)
downloadpasst-88c2f08eba342d52bf722533d270f0c84045d41c.tar
passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.gz
passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.bz2
passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.lz
passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.xz
passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.zst
passt-88c2f08eba342d52bf722533d270f0c84045d41c.zip
apparmor: Fix access to procfs namespace entries in pasta's abstraction
From an original patch by Danish Prakash. With commit ff22a78d7b52 ("pasta: Don't try to watch namespaces in procfs with inotify, use timer instead"), if a filesystem-bound target namespace is passed on the command line, we'll grab a handle on its parent directory. That commit, however, didn't introduce a matching AppArmor rule. Add it here. To access a network namespace procfs entry, we also need a 'ptrace' rule. See commit 594dce66d3bb ("isolation: keep CAP_SYS_PTRACE when required") for details as to when we need this -- essentially, it's about operation with Buildah. Reported-by: Jörg Sonnenberger <joerg@bec.de> Link: https://github.com/containers/buildah/issues/5440 Link: https://bugzilla.suse.com/show_bug.cgi?id=1221840 Fixes: ff22a78d7b52 ("pasta: Don't try to watch namespaces in procfs with inotify, use timer instead") Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'contrib/apparmor/abstractions')
-rw-r--r--contrib/apparmor/abstractions/pasta3
1 files changed, 3 insertions, 0 deletions
diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index 060caab..581ad1b 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -29,6 +29,7 @@
@{run}/user/@{uid}/** rw, # pasta_open_ns(), main()
+ @{PROC}/[0-9]*/ns/ r, # pasta_netns_quit_init(),
@{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(),
@{PROC}/[0-9]*/ns/user r, # conf_pasta_ns()
@@ -42,3 +43,5 @@
/{usr/,}bin/** Ux,
/usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c
+
+ ptrace r, # pasta_open_ns()