mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

passt, pasta: Add examples of AppArmor policies

Browse source 
These should cover any reasonably common use case in distributions.

Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
Stefano Brivio 2022-03-27 21:58:11 +02:00
parent f643c69806
commit e9d573b14f
2 changed files with 125 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
contrib/apparmor/usr.bin.passt Normal file
View file

@ -0,0 +1,59 @@
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# PASST - Plug A Simple Socket Transport
# for qemu/UNIX domain socket mode
#
# contrib/apparmor/usr.bin.passt - AppArmor profile example/template for passt
#
# Copyright (c) 2022 Red Hat GmbH
# Author: Stefano Brivio <sbrivio@redhat.com>
abi <abi/3.0>,
include <tunables/global>
/usr/bin/passt {
### Alternatively: include <abstractions/base>
@{etc_ro}/ld.so.cache r,
/{usr/,}lib{,32,64}/ld-*.so r,
/{usr/,}lib{,32,64}/libc-*.so mr,
/{usr/,}lib/@{multiarch}/ld-*.so r,
/{usr/,}lib/@{multiarch}/libc-*.so mr,
/dev/null rw, # __daemon(), util.c
signal receive set=int peer=unconfined,
signal receive set=term peer=unconfined,
###
### Alternatively: include <abstractions/nameservice>
@{etc_ro}/resolv.conf r, # get_dns(), conf.c
###
capability sys_admin, # sandbox(), passt.c
capability setpcap, # drop_caps(), util.c
mount "" -> "/", # sandbox(), passt.c
mount "" -> "/tmp/",
pivot_root "/tmp/" -> "/tmp/",
umount "/",
network netlink raw, # netlink.c
network inet stream, # tcp.c
network inet6 stream,
network inet dgram, # udp.c
network inet6 dgram,
network unix stream, # tap.c
network unix dgram, # __openlog(), util.c
### Alternatively: include <abstractions/user-tmp>
owner /tmp/** w, # tap_sock_unix_init(), pcap(),
# write_pidfile()
###
owner @{HOME}/** w, # pcap(), write_pidfile()
/usr/bin/passt.avx2 ix, # arch_avx2_exec(), arch.c
}

66
contrib/apparmor/usr.bin.pasta Normal file
View file

@ -0,0 +1,66 @@
# SPDX-License-Identifier: AGPL-3.0-or-later
#
# PASTA - Pack A Subtle Tap Abstraction
# for network namespace/tap device mode
#
# contrib/apparmor/usr.bin.pasta - AppArmor profile example/template for pasta
#
# Copyright (c) 2022 Red Hat GmbH
# Author: Stefano Brivio <sbrivio@redhat.com>
abi <abi/3.0>,
include <tunables/global>
/usr/bin/pasta flags=(attach_disconnected) {
include <abstractions/base> # Interactive shell
include <abstractions/nameservice>
include <abstractions/consoles>
include <abstractions/bash>
owner /proc/**/ns/user r,
/ r,
capability sys_ptrace, # bash
capability dac_read_search,
capability dac_override,
@{etc_ro}/** r,
/usr/** r,
/lib/** r,
owner @{HOME}/** rw,
owner /tmp/** rw,
/proc/*/net/tcp r, # procfs_scan_listen(), util.c
/proc/*/net/tcp6 r,
/proc/*/net/udp r,
/proc/*/net/udp6 r,
/dev/net/tun rw, # tap_ns_tun(), tap.c
capability net_admin, # for network namespace only
capability setpcap, # drop_caps(), util.c
capability sys_admin, # sandbox(), passt.c
mount "" -> "/", # sandbox(), passt.c
mount "" -> "/tmp/",
pivot_root "/tmp/" -> "/tmp/",
umount "/",
network netlink raw, # netlink.c
network inet stream, # tcp.c
network inet6 stream,
network inet dgram, # udp.c
network inet6 dgram,
network unix stream, # tap.c
network unix dgram, # __openlog(), util.c
owner /proc/*/gid_map w, # pasta_setup_ns()
owner /proc/*/setgroups w,
owner /proc/*/uid_map w,
owner /proc/sys/net/ipv4/ping_group_range w,
/{usr/,}bin/** mrix, # spawning shell
/usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c
}