[PATCH 3/3] apparmor: Fix access to procfs namespace entries in pasta's abstraction

[Stefano Brivio <sbrivio@redhat.com>]

From: Danish Prakash <danish.prakash@suse.com>

From an original patch by Danish Prakash.

With commit ff22a78d7b52 ("pasta: Don't try to watch namespaces in
procfs with inotify, use timer instead"), if a filesystem-bound
target namespace is passed on the command line, we'll grab a handle
on its parent directory. That commit, however, didn't introduce a
matching AppArmor rule. Add it here.

To access a network namespace procfs entry, we also need a 'ptrace'
rule. See commit 594dce66d3bb ("isolation: keep CAP_SYS_PTRACE when
required") for details as to when we need this -- essentially, it's
about operation with Buildah.

Reported-by: Jörg Sonnenberger <joerg@bec.de>
Link: https://github.com/containers/buildah/issues/5440
Link: https://bugzilla.suse.com/show_bug.cgi?id=1221840
Fixes: ff22a78d7b52 ("pasta: Don't try to watch namespaces in procfs with inotify, use timer instead")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/apparmor/abstractions/pasta | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index 060caab..581ad1b 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -29,6 +29,7 @@
 
   @{run}/user/@{uid}/**			rw,	# pasta_open_ns(), main()
 
+  @{PROC}/[0-9]*/ns/			r,	# pasta_netns_quit_init(),
   @{PROC}/[0-9]*/ns/net			r,	# pasta_wait_for_ns(),
   @{PROC}/[0-9]*/ns/user		r,	# conf_pasta_ns()
 
@@ -42,3 +43,5 @@
   /{usr/,}bin/**			Ux,
 
   /usr/bin/pasta.avx2			ix,	# arch_avx2_exec(), arch.c
+
+  ptrace				r,	# pasta_open_ns()
-- 
@@ -29,6 +29,7 @@
 
   @{run}/user/@{uid}/**			rw,	# pasta_open_ns(), main()
 
+  @{PROC}/[0-9]*/ns/			r,	# pasta_netns_quit_init(),
   @{PROC}/[0-9]*/ns/net			r,	# pasta_wait_for_ns(),
   @{PROC}/[0-9]*/ns/user		r,	# conf_pasta_ns()
 
@@ -42,3 +43,5 @@
   /{usr/,}bin/**			Ux,
 
   /usr/bin/pasta.avx2			ix,	# arch_avx2_exec(), arch.c
+
+  ptrace				r,	# pasta_open_ns()
-- 
2.43.0