aboutgitcodebugslistschat
path: root/contrib/apparmor
diff options
context:
space:
mode:
authorStefano Brivio <sbrivio@redhat.com>2022-03-27 21:58:11 +0200
committerStefano Brivio <sbrivio@redhat.com>2022-03-29 15:35:38 +0200
commite9d573b14f28bde604718513ed3d499f621090d8 (patch)
tree7b1508188adada80307c9c996492431610e9c53d /contrib/apparmor
parentf643c698063a6edd7cf658c5a2fb86ebab0a4627 (diff)
downloadpasst-e9d573b14f28bde604718513ed3d499f621090d8.tar
passt-e9d573b14f28bde604718513ed3d499f621090d8.tar.gz
passt-e9d573b14f28bde604718513ed3d499f621090d8.tar.bz2
passt-e9d573b14f28bde604718513ed3d499f621090d8.tar.lz
passt-e9d573b14f28bde604718513ed3d499f621090d8.tar.xz
passt-e9d573b14f28bde604718513ed3d499f621090d8.tar.zst
passt-e9d573b14f28bde604718513ed3d499f621090d8.zip
passt, pasta: Add examples of AppArmor policies
These should cover any reasonably common use case in distributions. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'contrib/apparmor')
-rw-r--r--contrib/apparmor/usr.bin.passt59
-rw-r--r--contrib/apparmor/usr.bin.pasta66
2 files changed, 125 insertions, 0 deletions
diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
new file mode 100644
index 0000000..a19fede
--- /dev/null
+++ b/contrib/apparmor/usr.bin.passt
@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# PASST - Plug A Simple Socket Transport
+# for qemu/UNIX domain socket mode
+#
+# contrib/apparmor/usr.bin.passt - AppArmor profile example/template for passt
+#
+# Copyright (c) 2022 Red Hat GmbH
+# Author: Stefano Brivio <sbrivio@redhat.com>
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+/usr/bin/passt {
+ ### Alternatively: include <abstractions/base>
+ @{etc_ro}/ld.so.cache r,
+ /{usr/,}lib{,32,64}/ld-*.so r,
+ /{usr/,}lib{,32,64}/libc-*.so mr,
+ /{usr/,}lib/@{multiarch}/ld-*.so r,
+ /{usr/,}lib/@{multiarch}/libc-*.so mr,
+ /dev/null rw, # __daemon(), util.c
+ signal receive set=int peer=unconfined,
+ signal receive set=term peer=unconfined,
+ ###
+
+ ### Alternatively: include <abstractions/nameservice>
+ @{etc_ro}/resolv.conf r, # get_dns(), conf.c
+ ###
+
+ capability sys_admin, # sandbox(), passt.c
+ capability setpcap, # drop_caps(), util.c
+
+ mount "" -> "/", # sandbox(), passt.c
+ mount "" -> "/tmp/",
+ pivot_root "/tmp/" -> "/tmp/",
+ umount "/",
+
+ network netlink raw, # netlink.c
+
+ network inet stream, # tcp.c
+ network inet6 stream,
+
+ network inet dgram, # udp.c
+ network inet6 dgram,
+
+ network unix stream, # tap.c
+
+ network unix dgram, # __openlog(), util.c
+
+ ### Alternatively: include <abstractions/user-tmp>
+ owner /tmp/** w, # tap_sock_unix_init(), pcap(),
+ # write_pidfile()
+ ###
+
+ owner @{HOME}/** w, # pcap(), write_pidfile()
+
+ /usr/bin/passt.avx2 ix, # arch_avx2_exec(), arch.c
+}
diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
new file mode 100644
index 0000000..844fcf3
--- /dev/null
+++ b/contrib/apparmor/usr.bin.pasta
@@ -0,0 +1,66 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# PASTA - Pack A Subtle Tap Abstraction
+# for network namespace/tap device mode
+#
+# contrib/apparmor/usr.bin.pasta - AppArmor profile example/template for pasta
+#
+# Copyright (c) 2022 Red Hat GmbH
+# Author: Stefano Brivio <sbrivio@redhat.com>
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+/usr/bin/pasta flags=(attach_disconnected) {
+ include <abstractions/base> # Interactive shell
+ include <abstractions/nameservice>
+ include <abstractions/consoles>
+ include <abstractions/bash>
+ owner /proc/**/ns/user r,
+ / r,
+ capability sys_ptrace, # bash
+ capability dac_read_search,
+ capability dac_override,
+ @{etc_ro}/** r,
+ /usr/** r,
+ /lib/** r,
+ owner @{HOME}/** rw,
+ owner /tmp/** rw,
+
+ /proc/*/net/tcp r, # procfs_scan_listen(), util.c
+ /proc/*/net/tcp6 r,
+ /proc/*/net/udp r,
+ /proc/*/net/udp6 r,
+
+ /dev/net/tun rw, # tap_ns_tun(), tap.c
+
+ capability net_admin, # for network namespace only
+ capability setpcap, # drop_caps(), util.c
+ capability sys_admin, # sandbox(), passt.c
+
+ mount "" -> "/", # sandbox(), passt.c
+ mount "" -> "/tmp/",
+ pivot_root "/tmp/" -> "/tmp/",
+ umount "/",
+
+ network netlink raw, # netlink.c
+
+ network inet stream, # tcp.c
+ network inet6 stream,
+
+ network inet dgram, # udp.c
+ network inet6 dgram,
+
+ network unix stream, # tap.c
+
+ network unix dgram, # __openlog(), util.c
+
+ owner /proc/*/gid_map w, # pasta_setup_ns()
+ owner /proc/*/setgroups w,
+ owner /proc/*/uid_map w,
+ owner /proc/sys/net/ipv4/ping_group_range w,
+ /{usr/,}bin/** mrix, # spawning shell
+
+ /usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c
+}