From f86196b822a64a14ac7f4ce8307d687135a486bd Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Fri, 2 Oct 2026 08:48:49 +0200 Subject: selinux: Allow passt to use setgid and setuid capabilities in namespace Starting from commit 7bf1595c9242 ("isolation: Don't create our userns as nobody"), we unconditionally set uidmap and gidmap in the detached user namespace. Allow that in SELinux rules. We also need to allow explicit access to the related files. While at it, add the matching class requirements in pasta.te, which I forgot (harmless as they were indirectly required, but not really correct). Link: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3a8fb909da#comment-4790590 Fixes: 71b74e924426 ("isolation: Don't create our userns as nobody") Signed-off-by: Stefano Brivio --- contrib/selinux/passt.te | 7 +++++-- contrib/selinux/pasta.te | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index 6995df8..e540473 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -23,6 +23,7 @@ require { type user_home_t; type tmpfs_t; type root_t; + type nsfs_t; # Workaround: passt --vhost-user needs to map guest memory, but # libvirt doesn't maintain its own policy, which makes updates @@ -61,7 +62,7 @@ require { type sysctl_net_t; class capability { sys_tty_config setuid setgid }; - class cap_userns { setpcap sys_admin sys_ptrace }; + class cap_userns { setpcap setgid setuid sys_admin sys_ptrace }; class user_namespace create; } @@ -104,11 +105,13 @@ allow syslogd_t self:cap_userns sys_ptrace; allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid}; -allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; +allow passt_t self:cap_userns { setgid setuid setpcap sys_admin sys_ptrace }; allow passt_t self:user_namespace create; auth_read_passwd(passt_t) +allow passt_t nsfs_t:file { open read }; + allow passt_t proc_net_t:file read; allow passt_t tmp_t:sock_file { create unlink write }; allow passt_t self:netlink_route_socket { bind create nlmsg_read read write setopt }; diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 9394f97..d0c9c32 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -87,7 +87,7 @@ require { type init_t; class capability { sys_tty_config setuid setgid }; - class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin }; + class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin setgid setuid }; class user_namespace create; # Container requires -- cgit v1.2.3