diff options
| author | Danish Prakash <danish.prakash@suse.com> | 2024-04-03 20:25:23 +0200 |
|---|---|---|
| committer | Stefano Brivio <sbrivio@redhat.com> | 2024-04-05 12:12:26 +0200 |
| commit | 88c2f08eba342d52bf722533d270f0c84045d41c (patch) | |
| tree | e2e202cf1e1fb427e7595e1f017f020f777d7501 /netlink.c | |
| parent | 100919ce745b987f57c8eb24e55e576c530d2be5 (diff) | |
| download | passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.gz passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.bz2 passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.lz passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.xz passt-88c2f08eba342d52bf722533d270f0c84045d41c.tar.zst passt-88c2f08eba342d52bf722533d270f0c84045d41c.zip | |
apparmor: Fix access to procfs namespace entries in pasta's abstraction
From an original patch by Danish Prakash.
With commit ff22a78d7b52 ("pasta: Don't try to watch namespaces in
procfs with inotify, use timer instead"), if a filesystem-bound
target namespace is passed on the command line, we'll grab a handle
on its parent directory. That commit, however, didn't introduce a
matching AppArmor rule. Add it here.
To access a network namespace procfs entry, we also need a 'ptrace'
rule. See commit 594dce66d3bb ("isolation: keep CAP_SYS_PTRACE when
required") for details as to when we need this -- essentially, it's
about operation with Buildah.
Reported-by: Jörg Sonnenberger <joerg@bec.de>
Link: https://github.com/containers/buildah/issues/5440
Link: https://bugzilla.suse.com/show_bug.cgi?id=1221840
Fixes: ff22a78d7b52 ("pasta: Don't try to watch namespaces in procfs with inotify, use timer instead")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
Diffstat (limited to 'netlink.c')
0 files changed, 0 insertions, 0 deletions