mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

apparmor: Expand scope of @{run}/user access, allow writing PID files too

Browse source 
With Podman's custom networks, pasta will typically need to open the
target network namespace at /run/user/<UID>/containers/networks:
grant access to anything under /run/user/<UID> instead of limiting it
to some subpath.

Note that in this case, Podman will need pasta to write out a PID
file, so we need write access, for similar locations, too.

Reported-by: Jörg Sonnenberger <joerg@bec.de>
Link: https://github.com/containers/buildah/issues/5440
Link: https://bugzilla.suse.com/show_bug.cgi?id=1221840
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2024-04-03 20:12:47 +02:00
parent dc7b7f28b7
commit 100919ce74
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
contrib/apparmor/abstractions/pasta
View file

@ -27,7 +27,7 @@
@{PROC}/@{pid}/net/udp r, @{PROC}/@{pid}/net/udp r,
@{PROC}/@{pid}/net/udp6 r, @{PROC}/@{pid}/net/udp6 r,
@{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c @{run}/user/@{uid}/** rw, # pasta_open_ns(), main()
@{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(), @{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(),
@{PROC}/[0-9]*/ns/user r, # conf_pasta_ns() @{PROC}/[0-9]*/ns/user r, # conf_pasta_ns()