From mboxrd@z Thu Jan  1 00:00:00 1970
Received: by passt.top (Postfix, from userid 1000)
	id CA7255A0276; Thu,  7 Sep 2023 00:35:15 +0200 (CEST)
From: Stefano Brivio <sbrivio@redhat.com>
To: passt-dev@passt.top
Subject: [PATCH 4/5] apparmor: Allow pasta to remount /proc, access entries under its own copy
Date: Thu,  7 Sep 2023 00:35:14 +0200
Message-Id: <20230906223515.2533706-5-sbrivio@redhat.com>
X-Mailer: git-send-email 2.39.2
In-Reply-To: <20230906223515.2533706-1-sbrivio@redhat.com>
References: <20230906223515.2533706-1-sbrivio@redhat.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Message-ID-Hash: NSTSWVPFYJHCOHNKD6CEAIIJPB5W2RIA
X-Message-ID-Hash: NSTSWVPFYJHCOHNKD6CEAIIJPB5W2RIA
X-MailFrom: sbrivio@passt.top
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: Paul Holzinger <pholzing@redhat.com>, David Gibson <david@gibson.dropbear.id.au>
X-Mailman-Version: 3.3.8
Precedence: list
List-Id: Development discussion and patches for passt <passt-dev.passt.top>
Archived-At: <https://archives.passt.top/passt-dev/20230906223515.2533706-5-sbrivio@redhat.com/>
Archived-At: <https://passt.top/hyperkitty/list/passt-dev@passt.top/message/NSTSWVPFYJHCOHNKD6CEAIIJPB5W2RIA/>
List-Archive: <https://archives.passt.top/passt-dev/>
List-Archive: <https://passt.top/hyperkitty/list/passt-dev@passt.top/>
List-Help: <mailto:passt-dev-request@passt.top?subject=help>
List-Owner: <mailto:passt-dev-owner@passt.top>
List-Post: <mailto:passt-dev@passt.top>
List-Subscribe: <mailto:passt-dev-join@passt.top>
List-Unsubscribe: <mailto:passt-dev-leave@passt.top>

Since commit b0e450aa8500 ("pasta: Detach mount namespace, (re)mount
procfs before spawning command"), we need to explicitly permit mount
of /proc, and access to entries under /proc/PID/net (after remount,
that's what AppArmor sees as path).

Fixes: b0e450aa8500 ("pasta: Detach mount namespace, (re)mount procfs before spawning command")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/apparmor/abstractions/pasta | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index 9cba25a..05c5d46 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -15,11 +15,18 @@
 
   include <abstractions/passt>
 
+  mount		""	-> "/proc/",
+
   @{PROC}/net/tcp			r,	# procfs_scan_listen(), util.c
   @{PROC}/net/tcp6			r,
   @{PROC}/net/udp			r,
   @{PROC}/net/udp6			r,
 
+  @{PROC}/@{pid}/net/tcp		r,	# procfs_scan_listen(), util.c
+  @{PROC}/@{pid}/net/tcp6		r,
+  @{PROC}/@{pid}/net/udp		r,
+  @{PROC}/@{pid}/net/udp6		r,
+
   @{run}/user/@{uid}/netns/*		r,	# pasta_open_ns(), pasta.c
 
   @{PROC}/[0-9]*/ns/net			r,	# pasta_wait_for_ns(),
-- 
2.39.2