From 63a8302961a421a67d38c52285be3c2ef149e6cc Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Wed, 6 Sep 2023 22:55:22 +0200 Subject: apparmor: Add pasta's own profile If pasta and pasta.avx2 are hard links to passt and passt.avx2, AppArmor will attach their own profiles on execution, and we can restrict passt's profile to what it actually needs. Note that pasta needs to access all the resources that passt needs, so the pasta abstraction still includes passt's one. I plan to push the adaptation required for the Debian package in commit 5bb812e79143 ("debian/rules: Override pasta symbolic links with hard links"), on Salsa. If other distributions need to support AppArmor profiles they can follow a similar approach. The profile itself will be installed, there, via dh_apparmor, in a separate commit, b52557fedcb1 ("debian/rules: Install new pasta profile using dh_apparmor"). Signed-off-by: Stefano Brivio --- contrib/apparmor/abstractions/pasta | 2 ++ 1 file changed, 2 insertions(+) (limited to 'contrib/apparmor/abstractions/pasta') diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta index 05c5d46..a890391 100644 --- a/contrib/apparmor/abstractions/pasta +++ b/contrib/apparmor/abstractions/pasta @@ -40,3 +40,5 @@ owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c /{usr/,}bin/** Ux, + + /usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c -- cgit v1.2.3