mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

apparmor: Add pasta's own profile

Browse source 
If pasta and pasta.avx2 are hard links to passt and passt.avx2,
AppArmor will attach their own profiles on execution, and we can
restrict passt's profile to what it actually needs. Note that pasta
needs to access all the resources that passt needs, so the pasta
abstraction still includes passt's one.

I plan to push the adaptation required for the Debian package in
commit 5bb812e79143 ("debian/rules: Override pasta symbolic links
with hard links"), on Salsa. If other distributions need to support
AppArmor profiles they can follow a similar approach.

The profile itself will be installed, there, via dh_apparmor, in a
separate commit, b52557fedcb1 ("debian/rules: Install new pasta
profile using dh_apparmor").

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2023-09-06 22:55:22 +02:00
parent abf5ef6c22
commit 63a8302961
3 changed files with 31 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
contrib/apparmor/abstractions/pasta
View file

@ -40,3 +40,5 @@
owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c
/{usr/,}bin/** Ux,
/usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c

12
contrib/apparmor/usr.bin.passt
View file

@ -6,7 +6,7 @@
# PASTA - Pack A Subtle Tap Abstraction
# for network namespace/tap device mode
#
# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1) and pasta(1)
# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1)
#
# Copyright (c) 2022 Red Hat GmbH
# Author: Stefano Brivio <sbrivio@redhat.com>
@ -15,13 +15,7 @@ abi <abi/3.0>,
include <tunables/global>
profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
### TODO: AppArmor doesn't give us the chance to attach a separate profile
### depending on the executable symlink. That's possible with SELinux. Two
### alternatives: implement that in AppArmor, or consider aa_change_hat(2).
### With this, rules for passt(1) could be restricted significantly. Note that
### the attach_disconnected flag is not needed for passt(1).
profile passt /usr/bin/passt{,.avx2} {
include <abstractions/passt>
# Alternatively: include <abstractions/user-tmp>
@ -30,6 +24,4 @@ profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
# logfile_init()
owner @{HOME}/** w, # pcap(), write_pidfile()
include <abstractions/pasta>
}

27
contrib/apparmor/usr.bin.pasta Normal file
View file

@ -0,0 +1,27 @@
# SPDX-License-Identifier: GPL-2.0-or-later
#
# PASST - Plug A Simple Socket Transport
# for qemu/UNIX domain socket mode
#
# PASTA - Pack A Subtle Tap Abstraction
# for network namespace/tap device mode
#
# contrib/apparmor/usr.bin.pasta - AppArmor profile for pasta(1)
#
# Copyright (c) 2022 Red Hat GmbH
# Author: Stefano Brivio <sbrivio@redhat.com>
abi <abi/3.0>,
include <tunables/global>
profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
include <abstractions/pasta>
# Alternatively: include <abstractions/user-tmp>
owner /tmp/** w, # tap_sock_unix_init(), pcap(),
# write_pidfile(),
# logfile_init()
owner @{HOME}/** w, # pcap(), write_pidfile()
}