ca2749e1bd
In practical terms, passt doesn't benefit from the additional protection offered by the AGPL over the GPL, because it's not suitable to be executed over a computer network. Further, restricting the distribution under the version 3 of the GPL wouldn't provide any practical advantage either, as long as the passt codebase is concerned, and might cause unnecessary compatibility dilemmas. Change licensing terms to the GNU General Public License Version 2, or any later version, with written permission from all current and past contributors, namely: myself, David Gibson, Laine Stump, Andrea Bolognani, Paul Holzinger, Richard W.M. Jones, Chris Kuhn, Florian Weimer, Giuseppe Scrivano, Stefan Hajnoczi, and Vasiliy Ulyanov. Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
35 lines
979 B
Text
35 lines
979 B
Text
# SPDX-License-Identifier: GPL-2.0-or-later
|
|
#
|
|
# PASST - Plug A Simple Socket Transport
|
|
# for qemu/UNIX domain socket mode
|
|
#
|
|
# PASTA - Pack A Subtle Tap Abstraction
|
|
# for network namespace/tap device mode
|
|
#
|
|
# contrib/apparmor/abstractions/pasta - Abstraction for pasta(1)
|
|
#
|
|
# Copyright (c) 2022 Red Hat GmbH
|
|
# Author: Stefano Brivio <sbrivio@redhat.com>
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <abstractions/passt>
|
|
|
|
@{PROC}/net/tcp r, # procfs_scan_listen(), util.c
|
|
@{PROC}/net/tcp6 r,
|
|
@{PROC}/net/udp r,
|
|
@{PROC}/net/udp6 r,
|
|
|
|
@{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c
|
|
|
|
@{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(),
|
|
@{PROC}/[0-9]*/ns/user r, # conf_pasta_ns()
|
|
|
|
/dev/net/tun rw, # tap_ns_tun(), tap.c
|
|
|
|
owner @{PROC}/@{pid}/gid_map w, # pasta_start_ns(), conf_ugid()
|
|
owner @{PROC}/@{pid}/setgroups w,
|
|
owner @{PROC}/@{pid}/uid_map rw,
|
|
|
|
owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c
|
|
/{usr/,}bin/** Ux,
|