ca2749e1bd
In practical terms, passt doesn't benefit from the additional protection offered by the AGPL over the GPL, because it's not suitable to be executed over a computer network. Further, restricting the distribution under the version 3 of the GPL wouldn't provide any practical advantage either, as long as the passt codebase is concerned, and might cause unnecessary compatibility dilemmas. Change licensing terms to the GNU General Public License Version 2, or any later version, with written permission from all current and past contributors, namely: myself, David Gibson, Laine Stump, Andrea Bolognani, Paul Holzinger, Richard W.M. Jones, Chris Kuhn, Florian Weimer, Giuseppe Scrivano, Stefan Hajnoczi, and Vasiliy Ulyanov. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
35 lines
1.1 KiB
Text
35 lines
1.1 KiB
Text
# SPDX-License-Identifier: GPL-2.0-or-later
|
|
#
|
|
# PASST - Plug A Simple Socket Transport
|
|
# for qemu/UNIX domain socket mode
|
|
#
|
|
# PASTA - Pack A Subtle Tap Abstraction
|
|
# for network namespace/tap device mode
|
|
#
|
|
# contrib/apparmor/usr.bin.passt - AppArmor profile for passt(1) and pasta(1)
|
|
#
|
|
# Copyright (c) 2022 Red Hat GmbH
|
|
# Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
|
|
### TODO: AppArmor doesn't give us the chance to attach a separate profile
|
|
### depending on the executable symlink. That's possible with SELinux. Two
|
|
### alternatives: implement that in AppArmor, or consider aa_change_hat(2).
|
|
### With this, rules for passt(1) could be restricted significantly. Note that
|
|
### the attach_disconnected flag is not needed for passt(1).
|
|
|
|
include <abstractions/passt>
|
|
|
|
# Alternatively: include <abstractions/user-tmp>
|
|
owner /tmp/** w, # tap_sock_unix_init(), pcap(),
|
|
# write_pidfile(),
|
|
# logfile_init()
|
|
|
|
owner @{HOME}/** w, # pcap(), write_pidfile()
|
|
|
|
include <abstractions/pasta>
|
|
}
|