mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

apparmor: Allow read-only access to uid_map

Browse source 
Starting with commit 770d1a4502 ("isolation: Initially Keep
CAP_SETFCAP if running as UID 0 in non-init"), the lack of this rule
became more apparent as pasta needs to access uid_map in procfs even
as non-root.

However, both passt and pasta needs this, in case they are started as
root, so add this directly to passt's abstraction (which is sourced
by pasta's profile too).

Fixes: 770d1a4502 ("isolation: Initially Keep CAP_SETFCAP if running as UID 0 in non-init")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2023-09-06 21:09:47 +02:00
parent b686afa23e
commit e2ad420fa2
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
contrib/apparmor/abstractions/passt
View file

@ -31,6 +31,8 @@
pivot_root "/tmp/" -> "/tmp/", pivot_root "/tmp/" -> "/tmp/",
umount "/", umount "/",
owner @{PROC}/@{pid}/uid_map r, # conf_ugid()
network netlink raw, # nl_sock_init_do(), netlink.c network netlink raw, # nl_sock_init_do(), netlink.c
network inet stream, # tcp.c network inet stream, # tcp.c