public inbox for passt-dev@passt.top
 help / color / mirror / code / Atom feed
* [PATCH] apparmor: allow read access on /tmp for pasta
@ 2024-05-08 16:13 Paul Holzinger
  2024-05-10 15:37 ` Stefano Brivio
  0 siblings, 1 reply; 2+ messages in thread
From: Paul Holzinger @ 2024-05-08 16:13 UTC (permalink / raw)
  To: passt-dev; +Cc: Paul Holzinger

The podman CI on debian runs tests based on /tmp but pasta is failing
there because it is unable to open the netns path as the open for read
access is denied.

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
---
 contrib/apparmor/usr.bin.pasta | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
index e5ee4df..2a4d28c 100644
--- a/contrib/apparmor/usr.bin.pasta
+++ b/contrib/apparmor/usr.bin.pasta
@@ -19,9 +19,10 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
   include <abstractions/pasta>
 
   # Alternatively: include <abstractions/user-tmp>
-  owner /tmp/**				w,	# tap_sock_unix_init(), pcap(),
+  owner /tmp/**				rw,	# tap_sock_unix_init(), pcap(),
 						# write_pidfile(),
-						# logfile_init()
+						# logfile_init(),
+						# pasta_open_ns()
 
   owner @{HOME}/**			w,	# pcap(), write_pidfile()
 }
-- 
@@ -19,9 +19,10 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
   include <abstractions/pasta>
 
   # Alternatively: include <abstractions/user-tmp>
-  owner /tmp/**				w,	# tap_sock_unix_init(), pcap(),
+  owner /tmp/**				rw,	# tap_sock_unix_init(), pcap(),
 						# write_pidfile(),
-						# logfile_init()
+						# logfile_init(),
+						# pasta_open_ns()
 
   owner @{HOME}/**			w,	# pcap(), write_pidfile()
 }
-- 
2.44.0


^ permalink raw reply related	[flat|nested] 2+ messages in thread

* Re: [PATCH] apparmor: allow read access on /tmp for pasta
  2024-05-08 16:13 [PATCH] apparmor: allow read access on /tmp for pasta Paul Holzinger
@ 2024-05-10 15:37 ` Stefano Brivio
  0 siblings, 0 replies; 2+ messages in thread
From: Stefano Brivio @ 2024-05-10 15:37 UTC (permalink / raw)
  To: Paul Holzinger; +Cc: passt-dev

On Wed,  8 May 2024 18:13:16 +0200
Paul Holzinger <pholzing@redhat.com> wrote:

> The podman CI on debian runs tests based on /tmp but pasta is failing
> there because it is unable to open the netns path as the open for read
> access is denied.
> 
> Signed-off-by: Paul Holzinger <pholzing@redhat.com>

Applied.

-- 
Stefano


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2024-05-10 15:38 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-05-08 16:13 [PATCH] apparmor: allow read access on /tmp for pasta Paul Holzinger
2024-05-10 15:37 ` Stefano Brivio

Code repositories for project(s) associated with this public inbox

	https://passt.top/passt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).