[PATCH] apparmor: allow netns paths on /tmp

[PATCH] apparmor: allow netns paths on /tmp

[Paul Holzinger]

For some unknown reason "owner" makes it impossible to open bind mounted
netns references as apparmor denies it. In the kernel denied log entry
we see ouid=0 but it is not clear why that is as the actual file is
owned by the real (rootless) user id.

In abstractions/pasta there is already `@{run}/user/@{uid}/**` without
owner set for the same reason as this path contains the netns path by
default when running under Podman.

Fixes: 72884484b00d ("apparmor: allow read access on /tmp for pasta")

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
---
 contrib/apparmor/usr.bin.pasta | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
index 2a4d28c..bdfeb71 100644
--- a/contrib/apparmor/usr.bin.pasta
+++ b/contrib/apparmor/usr.bin.pasta
@@ -19,7 +19,7 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
   include <abstractions/pasta>
 
   # Alternatively: include <abstractions/user-tmp>
-  owner /tmp/**				rw,	# tap_sock_unix_init(), pcap(),
+  /tmp/**				rw,	# tap_sock_unix_init(), pcap(),
 						# write_pidfile(),
 						# logfile_init(),
 						# pasta_open_ns()
-- 
@@ -19,7 +19,7 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
   include <abstractions/pasta>
 
   # Alternatively: include <abstractions/user-tmp>
-  owner /tmp/**				rw,	# tap_sock_unix_init(), pcap(),
+  /tmp/**				rw,	# tap_sock_unix_init(), pcap(),
 						# write_pidfile(),
 						# logfile_init(),
 						# pasta_open_ns()
-- 
2.45.0

Re: [PATCH] apparmor: allow netns paths on /tmp

[Stefano Brivio]

On Mon, 13 May 2024 19:41:55 +0200
Paul Holzinger <pholzing@redhat.com> wrote:

> For some unknown reason "owner" makes it impossible to open bind mounted
> netns references as apparmor denies it. In the kernel denied log entry
> we see ouid=0 but it is not clear why that is as the actual file is
> owned by the real (rootless) user id.
> 
> In abstractions/pasta there is already `@{run}/user/@{uid}/**` without
> owner set for the same reason as this path contains the netns path by
> default when running under Podman.
> 
> Fixes: 72884484b00d ("apparmor: allow read access on /tmp for pasta")
> 
> Signed-off-by: Paul Holzinger <pholzing@redhat.com>

Applied.

-- 
Stefano