public inbox for passt-dev@passt.top
 help / color / mirror / code / Atom feed
* [PATCH v2 0/7] Extensive bandaging for SELinux policy issues, old and new
@ 2023-08-16 18:17 Stefano Brivio
  2023-08-16 18:17 ` [PATCH v2 1/7] fedora: Install pasta as hard link to ensure SELinux file context match Stefano Brivio
                   ` (6 more replies)
  0 siblings, 7 replies; 10+ messages in thread
From: Stefano Brivio @ 2023-08-16 18:17 UTC (permalink / raw)
  To: passt-dev; +Cc: 'Richard W . M . Jones'

The most important fix here is actually the one that allows pasta and
passt to create user namespaces (and hence, to start -- we need that
for sandboxing) with recent kernels on e.g. Fedora Rawhide -- that's
patch 3/7.

But there are a number of other issues, some old, some new, that would
currently prevent pasta from e.g. starting a shell, or simply run
'ip address show', again at least on Fedora Rawhide. Fix them.

v2: Actually override pasta symlinks with hard links in 1/7

Stefano Brivio (7):
  fedora: Install pasta as hard link to ensure SELinux file context
    match
  selinux: Use explicit paths for binaries in file context
  selinux: Fix user namespace creation after breaking kernel change
  selinux: Update policy to fix user/group settings
  selinux: Add rules for sysctl and /proc/net accesses
  selinux: Allow pasta_t to read nsfs entries
  selinux: Fix domain transitions for typical commands pasta might run

 contrib/fedora/passt.spec |  7 +++++++
 contrib/selinux/passt.fc  |  3 ++-
 contrib/selinux/passt.te  | 10 ++++++++--
 contrib/selinux/pasta.fc  |  3 ++-
 contrib/selinux/pasta.te  | 33 ++++++++++++++++++++++++++++++---
 5 files changed, 49 insertions(+), 7 deletions(-)

-- 
2.39.2


^ permalink raw reply	[flat|nested] 10+ messages in thread

end of thread, other threads:[~2023-08-17 10:55 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-08-16 18:17 [PATCH v2 0/7] Extensive bandaging for SELinux policy issues, old and new Stefano Brivio
2023-08-16 18:17 ` [PATCH v2 1/7] fedora: Install pasta as hard link to ensure SELinux file context match Stefano Brivio
2023-08-17  7:53   ` Richard W.M. Jones
2023-08-17 10:53     ` Stefano Brivio
2023-08-16 18:17 ` [PATCH v2 2/7] selinux: Use explicit paths for binaries in file context Stefano Brivio
2023-08-16 18:17 ` [PATCH v2 3/7] selinux: Fix user namespace creation after breaking kernel change Stefano Brivio
2023-08-16 18:17 ` [PATCH v2 4/7] selinux: Update policy to fix user/group settings Stefano Brivio
2023-08-16 18:17 ` [PATCH v2 5/7] selinux: Add rules for sysctl and /proc/net accesses Stefano Brivio
2023-08-16 18:17 ` [PATCH v2 6/7] selinux: Allow pasta_t to read nsfs entries Stefano Brivio
2023-08-16 18:17 ` [PATCH v2 7/7] selinux: Fix domain transitions for typical commands pasta might run Stefano Brivio

Code repositories for project(s) associated with this public inbox

	https://passt.top/passt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).