From e9d573b14f28bde604718513ed3d499f621090d8 Mon Sep 17 00:00:00 2001
From: Stefano Brivio <sbrivio@redhat.com>
Date: Sun, 27 Mar 2022 21:58:11 +0200
Subject: [PATCH] passt, pasta: Add examples of AppArmor policies

These should cover any reasonably common use case in distributions.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/apparmor/usr.bin.passt | 59 ++++++++++++++++++++++++++++++
 contrib/apparmor/usr.bin.pasta | 66 ++++++++++++++++++++++++++++++++++
 2 files changed, 125 insertions(+)
 create mode 100644 contrib/apparmor/usr.bin.passt
 create mode 100644 contrib/apparmor/usr.bin.pasta

diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
new file mode 100644
index 0000000..a19fede
--- /dev/null
+++ b/contrib/apparmor/usr.bin.passt
@@ -0,0 +1,59 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# PASST - Plug A Simple Socket Transport
+#  for qemu/UNIX domain socket mode
+#
+# contrib/apparmor/usr.bin.passt - AppArmor profile example/template for passt
+#
+# Copyright (c) 2022 Red Hat GmbH
+# Author: Stefano Brivio <sbrivio@redhat.com>
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+/usr/bin/passt {
+  ### Alternatively: include <abstractions/base>
+  @{etc_ro}/ld.so.cache			r,
+  /{usr/,}lib{,32,64}/ld-*.so		r,
+  /{usr/,}lib{,32,64}/libc-*.so		mr,
+  /{usr/,}lib/@{multiarch}/ld-*.so	r,
+  /{usr/,}lib/@{multiarch}/libc-*.so	mr,
+  /dev/null 				rw,	# __daemon(), util.c
+  signal receive set=int peer=unconfined,
+  signal receive set=term peer=unconfined,
+  ###
+
+  ### Alternatively: include <abstractions/nameservice>
+  @{etc_ro}/resolv.conf			r,	# get_dns(), conf.c
+  ###
+
+  capability sys_admin,				# sandbox(), passt.c
+  capability setpcap,				# drop_caps(), util.c
+
+  mount		""	-> "/",			# sandbox(), passt.c
+  mount		""	-> "/tmp/",
+  pivot_root	"/tmp/" -> "/tmp/",
+  umount	"/",
+
+  network netlink raw,				# netlink.c
+
+  network inet stream,				# tcp.c
+  network inet6 stream,
+
+  network inet dgram,				# udp.c
+  network inet6 dgram,
+
+  network unix stream,				# tap.c
+
+  network unix dgram,				# __openlog(), util.c
+
+  ### Alternatively: include <abstractions/user-tmp>
+  owner /tmp/**				w,	# tap_sock_unix_init(), pcap(),
+						# write_pidfile()
+  ###
+
+  owner @{HOME}/**			w,	# pcap(), write_pidfile()
+
+  /usr/bin/passt.avx2			ix,	# arch_avx2_exec(), arch.c
+}
diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
new file mode 100644
index 0000000..844fcf3
--- /dev/null
+++ b/contrib/apparmor/usr.bin.pasta
@@ -0,0 +1,66 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+#
+# PASTA - Pack A Subtle Tap Abstraction
+#  for network namespace/tap device mode
+#
+# contrib/apparmor/usr.bin.pasta - AppArmor profile example/template for pasta
+#
+# Copyright (c) 2022 Red Hat GmbH
+# Author: Stefano Brivio <sbrivio@redhat.com>
+
+abi <abi/3.0>,
+
+include <tunables/global>
+
+/usr/bin/pasta flags=(attach_disconnected) {
+  include <abstractions/base>			# Interactive shell
+  include <abstractions/nameservice>
+  include <abstractions/consoles>
+  include <abstractions/bash>
+  owner /proc/**/ns/user		r,
+  /					r,
+  capability sys_ptrace,			# bash
+  capability dac_read_search,
+  capability dac_override,
+  @{etc_ro}/**				r,
+  /usr/**				r,
+  /lib/**				r,
+  owner @{HOME}/**			rw,
+  owner /tmp/**				rw,
+
+  /proc/*/net/tcp			r,	# procfs_scan_listen(), util.c
+  /proc/*/net/tcp6			r,
+  /proc/*/net/udp			r,
+  /proc/*/net/udp6			r,
+
+  /dev/net/tun				rw,	# tap_ns_tun(), tap.c
+
+  capability net_admin,				# for network namespace only
+  capability setpcap,				# drop_caps(), util.c
+  capability sys_admin,				# sandbox(), passt.c
+
+  mount		""	-> "/",			# sandbox(), passt.c
+  mount		""	-> "/tmp/",
+  pivot_root	"/tmp/" -> "/tmp/",
+  umount	"/",
+
+  network netlink raw,				# netlink.c
+
+  network inet stream,				# tcp.c
+  network inet6 stream,
+
+  network inet dgram,				# udp.c
+  network inet6 dgram,
+
+  network unix stream,				# tap.c
+
+  network unix dgram,				# __openlog(), util.c
+
+  owner /proc/*/gid_map			w,	# pasta_setup_ns()
+  owner /proc/*/setgroups		w,
+  owner /proc/*/uid_map			w,
+  owner /proc/sys/net/ipv4/ping_group_range w,
+  /{usr/,}bin/**			mrix,	# spawning shell
+
+  /usr/bin/pasta.avx2			ix,	# arch_avx2_exec(), arch.c
+}