aboutgitcodebugslistschat
path: root/contrib
diff options
context:
space:
mode:
Diffstat (limited to 'contrib')
-rw-r--r--contrib/apparmor/abstractions/pasta2
-rw-r--r--contrib/apparmor/usr.bin.passt12
-rw-r--r--contrib/apparmor/usr.bin.pasta27
3 files changed, 31 insertions, 10 deletions
diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index 05c5d46..a890391 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -40,3 +40,5 @@
owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c
/{usr/,}bin/** Ux,
+
+ /usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c
diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
index 652051d..564f82f 100644
--- a/contrib/apparmor/usr.bin.passt
+++ b/contrib/apparmor/usr.bin.passt
@@ -6,7 +6,7 @@
# PASTA - Pack A Subtle Tap Abstraction
# for network namespace/tap device mode
#
-# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1) and pasta(1)
+# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1)
#
# Copyright (c) 2022 Red Hat GmbH
# Author: Stefano Brivio <sbrivio@redhat.com>
@@ -15,13 +15,7 @@ abi <abi/3.0>,
include <tunables/global>
-profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
- ### TODO: AppArmor doesn't give us the chance to attach a separate profile
- ### depending on the executable symlink. That's possible with SELinux. Two
- ### alternatives: implement that in AppArmor, or consider aa_change_hat(2).
- ### With this, rules for passt(1) could be restricted significantly. Note that
- ### the attach_disconnected flag is not needed for passt(1).
-
+profile passt /usr/bin/passt{,.avx2} {
include <abstractions/passt>
# Alternatively: include <abstractions/user-tmp>
@@ -30,6 +24,4 @@ profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
# logfile_init()
owner @{HOME}/** w, # pcap(), write_pidfile()
-
- include <abstractions/pasta>
}
diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
new file mode 100644
index 0000000..e5ee4df
--- /dev/null
+++ b/contrib/apparmor/usr.bin.pasta
@@ -0,0 +1,27 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# PASST - Plug A Simple Socket Transport
+# for qemu/UNIX domain socket mode
+#
+# PASTA - Pack A Subtle Tap Abstraction
+# for network namespace/tap device mode
+#
+# contrib/apparmor/usr.bin.pasta - AppArmor profile for pasta(1)
+#
+# Copyright (c) 2022 Red Hat GmbH
+# Author: Stefano Brivio <sbrivio@redhat.com>
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
+ include <abstractions/pasta>
+
+ # Alternatively: include <abstractions/user-tmp>
+ owner /tmp/** w, # tap_sock_unix_init(), pcap(),
+ # write_pidfile(),
+ # logfile_init()
+
+ owner @{HOME}/** w, # pcap(), write_pidfile()
+}