From abf5ef6c22d2e6fce0f0abe398a2c18b70ca6290 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Wed, 6 Sep 2023 21:46:14 +0200 Subject: apparmor: Allow pasta to remount /proc, access entries under its own copy Since commit b0e450aa8500 ("pasta: Detach mount namespace, (re)mount procfs before spawning command"), we need to explicitly permit mount of /proc, and access to entries under /proc/PID/net (after remount, that's what AppArmor sees as path). Fixes: b0e450aa8500 ("pasta: Detach mount namespace, (re)mount procfs before spawning command") Signed-off-by: Stefano Brivio --- contrib/apparmor/abstractions/pasta | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta index 9cba25a..05c5d46 100644 --- a/contrib/apparmor/abstractions/pasta +++ b/contrib/apparmor/abstractions/pasta @@ -15,11 +15,18 @@ include + mount "" -> "/proc/", + @{PROC}/net/tcp r, # procfs_scan_listen(), util.c @{PROC}/net/tcp6 r, @{PROC}/net/udp r, @{PROC}/net/udp6 r, + @{PROC}/@{pid}/net/tcp r, # procfs_scan_listen(), util.c + @{PROC}/@{pid}/net/tcp6 r, + @{PROC}/@{pid}/net/udp r, + @{PROC}/@{pid}/net/udp6 r, + @{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c @{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(), -- cgit v1.2.3