From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id C622C5A0274; Thu, 7 Sep 2023 00:35:15 +0200 (CEST) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH 2/5] apparmor: Explicitly pass options we use while remounting root filesystem Date: Thu, 7 Sep 2023 00:35:12 +0200 Message-Id: <20230906223515.2533706-3-sbrivio@redhat.com> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230906223515.2533706-1-sbrivio@redhat.com> References: <20230906223515.2533706-1-sbrivio@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: XWV5QSSBDKFJ6PQKDO4EHR2AY4KP6WVE X-Message-ID-Hash: XWV5QSSBDKFJ6PQKDO4EHR2AY4KP6WVE X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Paul Holzinger , David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: As a result of AppArmor commit d4b0fef10a4a ("parser: fix rule flag generation change_mount type rules"), we can't expect anymore to get permission to mount() / read-write, with MS_REC | MS_UNBINDABLE ("runbindable", in AppArmor terms), if we don't explicitly pass those flags as options. It used to work by mistake. Now, the reasonable expectation would be that we could just change the existing rule into: mount options=(rw, runbindable) "" -> /, ...but this now fails to load too, I think as a result of AppArmor commit 9d3f8c6cc05d ("parser: fix parsing of source as mount point for propagation type flags"). It works with 'rw' alone, but 'runbindable' is indeed a propagation type flag. Skip the source specification, it doesn't add anything meaningful to the rule anyway. Reported-by: Paul Holzinger Link: https://github.com/containers/podman/pull/19751 Signed-off-by: Stefano Brivio --- contrib/apparmor/abstractions/passt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index a16eb6e..d778222 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -26,7 +26,7 @@ capability sys_ptrace, / r, # isolate_prefork(), isolation.c - mount "" -> "/", + mount options=(rw, runbindable) /, mount "" -> "/tmp/", pivot_root "/tmp/" -> "/tmp/", umount "/", -- 2.39.2