diff options
| -rw-r--r-- | contrib/apparmor/abstractions/passt | 4 | ||||
| -rw-r--r-- | contrib/apparmor/abstractions/pasta | 4 | ||||
| -rw-r--r-- | contrib/apparmor/usr.bin.passt | 2 |
3 files changed, 4 insertions, 6 deletions
diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index f4570c1..0aeb19d 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -34,7 +34,9 @@ pivot_root "/tmp/" -> "/tmp/", umount "/", - owner @{PROC}/@{pid}/uid_map r, # conf_ugid() + owner @{PROC}/@{pid}/gid_map w, # make_ugid_map() + owner @{PROC}/@{pid}/setgroups w, + owner @{PROC}/@{pid}/uid_map rw, @{PROC}/sys/net/ipv4/ip_local_port_range r, # fwd_probe_ephemeral() diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta index 251d4a2..89fa427 100644 --- a/contrib/apparmor/abstractions/pasta +++ b/contrib/apparmor/abstractions/pasta @@ -35,10 +35,6 @@ /dev/net/tun rw, # tap_ns_tun(), tap.c - owner @{PROC}/@{pid}/gid_map w, # pasta_start_ns(), conf_ugid() - owner @{PROC}/@{pid}/setgroups w, - owner @{PROC}/@{pid}/uid_map rw, - owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c /{usr/,}bin/** Ux, diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index da49e37..ccc2ea9 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -15,7 +15,7 @@ abi <abi/4.0>, include <tunables/global> -profile passt /usr/bin/passt{,.avx2} { +profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) { include <abstractions/passt> include <abstractions/user-tmp> # tap_sock_unix_open(), |