diff options
| -rw-r--r-- | contrib/apparmor/usr.bin.passt | 73 | ||||
| -rw-r--r-- | contrib/apparmor/usr.bin.pasta | 66 |
2 files changed, 51 insertions, 88 deletions
diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index a19fede..96b61ef 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -3,7 +3,10 @@ # PASST - Plug A Simple Socket Transport # for qemu/UNIX domain socket mode # -# contrib/apparmor/usr.bin.passt - AppArmor profile example/template for passt +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1) and pasta(1) # # Copyright (c) 2022 Red Hat GmbH # Author: Stefano Brivio <sbrivio@redhat.com> @@ -12,31 +15,29 @@ abi <abi/3.0>, include <tunables/global> -/usr/bin/passt { - ### Alternatively: include <abstractions/base> - @{etc_ro}/ld.so.cache r, - /{usr/,}lib{,32,64}/ld-*.so r, - /{usr/,}lib{,32,64}/libc-*.so mr, - /{usr/,}lib/@{multiarch}/ld-*.so r, - /{usr/,}lib/@{multiarch}/libc-*.so mr, - /dev/null rw, # __daemon(), util.c - signal receive set=int peer=unconfined, - signal receive set=term peer=unconfined, - ### +profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) { + ### Common rules for passt and pasta - ### Alternatively: include <abstractions/nameservice> + include <abstractions/base> + + # Alternatively: include <abstractions/nameservice> @{etc_ro}/resolv.conf r, # get_dns(), conf.c - ### - capability sys_admin, # sandbox(), passt.c - capability setpcap, # drop_caps(), util.c + capability net_bind_service, # isolation.c, conf.c + capability setuid, + capability setgid, + capability sys_admin, + capability setpcap, + capability net_admin, + capability sys_ptrace, - mount "" -> "/", # sandbox(), passt.c + / r, # isolate_prefork(), isolation.c + mount "" -> "/", mount "" -> "/tmp/", pivot_root "/tmp/" -> "/tmp/", umount "/", - network netlink raw, # netlink.c + network netlink raw, # nl_sock_init_do(), netlink.c network inet stream, # tcp.c network inet6 stream, @@ -46,14 +47,42 @@ include <tunables/global> network unix stream, # tap.c - network unix dgram, # __openlog(), util.c + network unix dgram, # __openlog(), log.c - ### Alternatively: include <abstractions/user-tmp> + # Alternatively: include <abstractions/user-tmp> owner /tmp/** w, # tap_sock_unix_init(), pcap(), - # write_pidfile() - ### + # write_pidfile(), + # logfile_init() owner @{HOME}/** w, # pcap(), write_pidfile() /usr/bin/passt.avx2 ix, # arch_avx2_exec(), arch.c + + + ### Rules for pasta + ### + ### TODO: AppArmor doesn't give us the chance to attach a separate profile + ### depending on the executable symlink. That's possible with SELinux. Two + ### alternatives: implement that in AppArmor, or consider aa_change_hat(2). + ### With this, rules for passt(1) could be restricted significantly. Note that + ### the attach_disconnected flag is not needed for passt(1). + + @{PROC}/net/tcp r, # procfs_scan_listen(), util.c + @{PROC}/net/tcp6 r, + @{PROC}/net/udp r, + @{PROC}/net/udp6 r, + + @{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c + + @{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(), + @{PROC}/[0-9]*/ns/user r, # conf_pasta_ns() + + /dev/net/tun rw, # tap_ns_tun(), tap.c + + owner @{PROC}/@{pid}/gid_map w, # pasta_start_ns(), conf_ugid() + owner @{PROC}/@{pid}/setgroups w, + owner @{PROC}/@{pid}/uid_map rw, + + owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c + /{usr/,}bin/** Ux, } diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta deleted file mode 100644 index 844fcf3..0000000 --- a/contrib/apparmor/usr.bin.pasta +++ /dev/null @@ -1,66 +0,0 @@ -# SPDX-License-Identifier: AGPL-3.0-or-later -# -# PASTA - Pack A Subtle Tap Abstraction -# for network namespace/tap device mode -# -# contrib/apparmor/usr.bin.pasta - AppArmor profile example/template for pasta -# -# Copyright (c) 2022 Red Hat GmbH -# Author: Stefano Brivio <sbrivio@redhat.com> - -abi <abi/3.0>, - -include <tunables/global> - -/usr/bin/pasta flags=(attach_disconnected) { - include <abstractions/base> # Interactive shell - include <abstractions/nameservice> - include <abstractions/consoles> - include <abstractions/bash> - owner /proc/**/ns/user r, - / r, - capability sys_ptrace, # bash - capability dac_read_search, - capability dac_override, - @{etc_ro}/** r, - /usr/** r, - /lib/** r, - owner @{HOME}/** rw, - owner /tmp/** rw, - - /proc/*/net/tcp r, # procfs_scan_listen(), util.c - /proc/*/net/tcp6 r, - /proc/*/net/udp r, - /proc/*/net/udp6 r, - - /dev/net/tun rw, # tap_ns_tun(), tap.c - - capability net_admin, # for network namespace only - capability setpcap, # drop_caps(), util.c - capability sys_admin, # sandbox(), passt.c - - mount "" -> "/", # sandbox(), passt.c - mount "" -> "/tmp/", - pivot_root "/tmp/" -> "/tmp/", - umount "/", - - network netlink raw, # netlink.c - - network inet stream, # tcp.c - network inet6 stream, - - network inet dgram, # udp.c - network inet6 dgram, - - network unix stream, # tap.c - - network unix dgram, # __openlog(), util.c - - owner /proc/*/gid_map w, # pasta_setup_ns() - owner /proc/*/setgroups w, - owner /proc/*/uid_map w, - owner /proc/sys/net/ipv4/ping_group_range w, - /{usr/,}bin/** mrix, # spawning shell - - /usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c -} |