From f2683d14802d1430b383f48eb3105f11361edda1 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Fri, 25 Sep 2026 22:38:51 +0200 Subject: apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only Podman overrides TMPDIR to /var/tmp, and an upcoming change in the requires pasta to write its PID file to TMPDIR. To support this in the AppArmor policy, we need to loosen the existing rule restricting file writes to /tmp/ and subpaths in order to include common alternative paths for TMPDIR: the user-tmp abstraction does exactly this. Reported-by: Giuseppe Scrivano Link: https://github.com/podman-container-tools/container-libs/pull/1207 Signed-off-by: Stefano Brivio --- contrib/apparmor/usr.bin.passt | 3 +-- contrib/apparmor/usr.bin.pasta | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index c123a86..da49e37 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -18,8 +18,7 @@ include profile passt /usr/bin/passt{,.avx2} { include - # Alternatively: include - owner /tmp/** w, # tap_sock_unix_open(), + include # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 56b5024..32dfad9 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -18,8 +18,7 @@ include profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include - # Alternatively: include - /tmp/** rw, # tap_sock_unix_open(), + include # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), -- cgit v1.2.3