mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

selinux: Allow pasta to remount procfs

Browse source 
Partially equivalent to commit abf5ef6c22 ("apparmor: Allow pasta
to remount /proc, access entries under its own copy"): we should
allow pasta to remount /proc. It still works otherwise, but further
UID remapping in nested user namespaces (e.g. pasta in pasta) won't.

Reported-by: Laurent Jacquot <jk@lutty.net>
Link: https://bugs.passt.top/show_bug.cgi?id=79#c3
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2024-02-16 09:43:12 +01:00
parent 338b6321ac
commit 08344dacb1
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
contrib/selinux/pasta.te
View file

@ -201,6 +201,8 @@ allow pasta_t kernel_t:system module_request;
allow pasta_t nsfs_t:file read; allow pasta_t nsfs_t:file read;
allow pasta_t proc_t:dir mounton;
allow pasta_t proc_t:filesystem mount;
allow pasta_t net_conf_t:lnk_file read; allow pasta_t net_conf_t:lnk_file read;
allow pasta_t proc_net_t:lnk_file read; allow pasta_t proc_net_t:lnk_file read;