From b3b26323aaeac6119577922e47e8cfa3ed3a16d0 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Wed, 6 May 2026 03:28:42 +0200 Subject: apparmor: Add policy file for pesto It needs to connect to passt and pasta, whether they're started as root or not, and the control socket can be anywhere. Signed-off-by: Stefano Brivio --- contrib/apparmor/usr.bin.pesto | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 contrib/apparmor/usr.bin.pesto diff --git a/contrib/apparmor/usr.bin.pesto b/contrib/apparmor/usr.bin.pesto new file mode 100644 index 0000000..0c072c7 --- /dev/null +++ b/contrib/apparmor/usr.bin.pesto @@ -0,0 +1,23 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PESTO - Programmable Extensible Socket Translation Orchestrator +# front-end for passt(1) and pasta(1) forwarding configuration +# +# contrib/apparmor/usr.bin.pesto - AppArmor profile for pesto(1) +# +# Copyright (c) 2026 Red Hat GmbH +# Author: Stefano Brivio + +abi , + +#include + +profile pesto /usr/bin/pesto { + #include + /** rw, # control socket might be anywhere + unix (connect, receive, send) type=stream, + + capability dac_override, # connect to passt's socket as root + + network unix stream, # connect and use UNIX domain socket +} -- cgit v1.2.3