diff options
| -rw-r--r-- | contrib/apparmor/abstractions/pasta | 2 | ||||
| -rw-r--r-- | contrib/apparmor/usr.bin.passt | 12 | ||||
| -rw-r--r-- | contrib/apparmor/usr.bin.pasta | 27 |
3 files changed, 31 insertions, 10 deletions
diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta index 05c5d46..a890391 100644 --- a/contrib/apparmor/abstractions/pasta +++ b/contrib/apparmor/abstractions/pasta @@ -40,3 +40,5 @@ owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c /{usr/,}bin/** Ux, + + /usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index 652051d..564f82f 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -6,7 +6,7 @@ # PASTA - Pack A Subtle Tap Abstraction # for network namespace/tap device mode # -# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1) and pasta(1) +# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1) # # Copyright (c) 2022 Red Hat GmbH # Author: Stefano Brivio <sbrivio@redhat.com> @@ -15,13 +15,7 @@ abi <abi/3.0>, include <tunables/global> -profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) { - ### TODO: AppArmor doesn't give us the chance to attach a separate profile - ### depending on the executable symlink. That's possible with SELinux. Two - ### alternatives: implement that in AppArmor, or consider aa_change_hat(2). - ### With this, rules for passt(1) could be restricted significantly. Note that - ### the attach_disconnected flag is not needed for passt(1). - +profile passt /usr/bin/passt{,.avx2} { include <abstractions/passt> # Alternatively: include <abstractions/user-tmp> @@ -30,6 +24,4 @@ profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) { # logfile_init() owner @{HOME}/** w, # pcap(), write_pidfile() - - include <abstractions/pasta> } diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta new file mode 100644 index 0000000..e5ee4df --- /dev/null +++ b/contrib/apparmor/usr.bin.pasta @@ -0,0 +1,27 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# contrib/apparmor/usr.bin.pasta - AppArmor profile for pasta(1) +# +# Copyright (c) 2022 Red Hat GmbH +# Author: Stefano Brivio <sbrivio@redhat.com> + +abi <abi/3.0>, + +include <tunables/global> + +profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { + include <abstractions/pasta> + + # Alternatively: include <abstractions/user-tmp> + owner /tmp/** w, # tap_sock_unix_init(), pcap(), + # write_pidfile(), + # logfile_init() + + owner @{HOME}/** w, # pcap(), write_pidfile() +} |