aboutgitcodebugslistschat
path: root/contrib/apparmor/abstractions
diff options
context:
space:
mode:
Diffstat (limited to 'contrib/apparmor/abstractions')
-rw-r--r--contrib/apparmor/abstractions/passt5
-rw-r--r--contrib/apparmor/abstractions/pasta5
2 files changed, 8 insertions, 2 deletions
diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt
index 6bb25e0..43fd63f 100644
--- a/contrib/apparmor/abstractions/passt
+++ b/contrib/apparmor/abstractions/passt
@@ -26,13 +26,16 @@
capability sys_ptrace,
/ r, # isolate_prefork(), isolation.c
- mount options=(rw, runbindable) /,
+ mount options=(rw, runbindable) -> /,
+ mount "" -> "/",
mount "" -> "/tmp/",
pivot_root "/tmp/" -> "/tmp/",
umount "/",
owner @{PROC}/@{pid}/uid_map r, # conf_ugid()
+ @{PROC}/sys/net/ipv4/ip_local_port_range r, # fwd_probe_ephemeral()
+
network netlink raw, # nl_sock_init_do(), netlink.c
network inet stream, # tcp.c
diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index a890391..9f73bee 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -27,8 +27,9 @@
@{PROC}/@{pid}/net/udp r,
@{PROC}/@{pid}/net/udp6 r,
- @{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c
+ @{run}/user/@{uid}/** rw, # pasta_open_ns()
+ @{PROC}/[0-9]*/ns/ r, # pasta_netns_quit_init(),
@{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(),
@{PROC}/[0-9]*/ns/user r, # conf_pasta_ns()
@@ -42,3 +43,5 @@
/{usr/,}bin/** Ux,
/usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c
+
+ ptrace r, # pasta_open_ns()