3 files changed, 31 insertions, 10 deletions
diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index 05c5d46..a890391 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -40,3 +40,5 @@
 
   owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c
   /{usr/,}bin/**			Ux,
+
+  /usr/bin/pasta.avx2			ix,	# arch_avx2_exec(), arch.c
diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
index 652051d..564f82f 100644
--- a/contrib/apparmor/usr.bin.passt
+++ b/contrib/apparmor/usr.bin.passt
@@ -6,7 +6,7 @@
 # PASTA - Pack A Subtle Tap Abstraction
 #  for network namespace/tap device mode
 #
-# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1) and pasta(1)
+# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1)
 #
 # Copyright (c) 2022 Red Hat GmbH
 # Author: Stefano Brivio <sbrivio@redhat.com>
@@ -15,13 +15,7 @@ abi <abi/3.0>,
 
 include <tunables/global>
 
-profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
-  ### TODO: AppArmor doesn't give us the chance to attach a separate profile
-  ### depending on the executable symlink. That's possible with SELinux. Two
-  ### alternatives: implement that in AppArmor, or consider aa_change_hat(2).
-  ### With this, rules for passt(1) could be restricted significantly. Note that
-  ### the attach_disconnected flag is not needed for passt(1).
-
+profile passt /usr/bin/passt{,.avx2} {
   include <abstractions/passt>
 
   # Alternatively: include <abstractions/user-tmp>
@@ -30,6 +24,4 @@ profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
 						# logfile_init()
 
   owner @{HOME}/**			w,	# pcap(), write_pidfile()
-
-  include <abstractions/pasta>
 }
diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
new file mode 100644
index 0000000..e5ee4df
--- /dev/null
+++ b/contrib/apparmor/usr.bin.pasta
@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# PASST - Plug A Simple Socket Transport
+#  for qemu/UNIX domain socket mode
+#
+# PASTA - Pack A Subtle Tap Abstraction
+#  for network namespace/tap device mode
+#
+# contrib/apparmor/usr.bin.pasta - AppArmor profile for pasta(1)
+#
+# Copyright (c) 2022 Red Hat GmbH
+# Author: Stefano Brivio <sbrivio@redhat.com>
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
+  include <abstractions/pasta>
+
+  # Alternatively: include <abstractions/user-tmp>
+  owner /tmp/**				w,	# tap_sock_unix_init(), pcap(),
+						# write_pidfile(),
+						# logfile_init()
+
+  owner @{HOME}/**			w,	# pcap(), write_pidfile()
+}