* [PATCH] apparmor: Fix passt abstraction
@ 2024-05-17 11:50 Maxime Bélair
2024-05-17 12:28 ` Stefano Brivio
0 siblings, 1 reply; 3+ messages in thread
From: Maxime Bélair @ 2024-05-17 11:50 UTC (permalink / raw)
To: passt-dev; +Cc: Maxime Bélair
Commit b686afa2 introduced the invalid apparmor rule `mount options=(rw, runbindable) /,` since runbindable mount rules cannot have a source.
Therefore running aa-logprof/aa-genprof will trigger errors (see https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685)
$ sudo aa-logprof
ERROR: Operation {'runbindable'} cannot have a source. Source = AARE('/')
This patch fixes it to the intended behavior.
Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
---
contrib/apparmor/abstractions/passt | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt
index 61ec32c..d245115 100644
--- a/contrib/apparmor/abstractions/passt
+++ b/contrib/apparmor/abstractions/passt
@@ -26,7 +26,7 @@
capability sys_ptrace,
/ r, # isolate_prefork(), isolation.c
- mount options=(rw, runbindable) /,
+ mount options=(rw, runbindable) -> /,
mount "" -> "/",
mount "" -> "/tmp/",
pivot_root "/tmp/" -> "/tmp/",
--
@@ -26,7 +26,7 @@
capability sys_ptrace,
/ r, # isolate_prefork(), isolation.c
- mount options=(rw, runbindable) /,
+ mount options=(rw, runbindable) -> /,
mount "" -> "/",
mount "" -> "/tmp/",
pivot_root "/tmp/" -> "/tmp/",
--
2.40.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] apparmor: Fix passt abstraction
2024-05-17 11:50 [PATCH] apparmor: Fix passt abstraction Maxime Bélair
@ 2024-05-17 12:28 ` Stefano Brivio
2024-05-21 7:50 ` Maxime Bélair
0 siblings, 1 reply; 3+ messages in thread
From: Stefano Brivio @ 2024-05-17 12:28 UTC (permalink / raw)
To: Maxime Bélair; +Cc: passt-dev
Hi Maxime,
On Fri, 17 May 2024 13:50:54 +0200
Maxime Bélair <maxime.belair@canonical.com> wrote:
> Commit b686afa2 introduced the invalid apparmor rule `mount options=(rw, runbindable) /,` since runbindable mount rules cannot have a source.
Oops, right, I didn't actually drop the source specification there. :(
Thanks for fixing this.
> Therefore running aa-logprof/aa-genprof will trigger errors (see https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685)
>
> $ sudo aa-logprof
> ERROR: Operation {'runbindable'} cannot have a source. Source = AARE('/')
I wonder why I don't see this on Debian testing with AppArmor 3.0.13
(same on openSUSE Tumbleweed).
Is there something in particular I should do to reproduce/check this?
> This patch fixes it to the intended behavior.
>
> Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
> ---
> contrib/apparmor/abstractions/passt | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt
> index 61ec32c..d245115 100644
> --- a/contrib/apparmor/abstractions/passt
> +++ b/contrib/apparmor/abstractions/passt
> @@ -26,7 +26,7 @@
> capability sys_ptrace,
>
> / r, # isolate_prefork(), isolation.c
> - mount options=(rw, runbindable) /,
> + mount options=(rw, runbindable) -> /,
> mount "" -> "/",
> mount "" -> "/tmp/",
> pivot_root "/tmp/" -> "/tmp/",
--
Stefano
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] apparmor: Fix passt abstraction
2024-05-17 12:28 ` Stefano Brivio
@ 2024-05-21 7:50 ` Maxime Bélair
0 siblings, 0 replies; 3+ messages in thread
From: Maxime Bélair @ 2024-05-21 7:50 UTC (permalink / raw)
To: Stefano Brivio; +Cc: passt-dev, Maxime Bélair
On 5/17/24 14:28, Stefano Brivio wrote:
> Hi Maxime,
Hi Stefano,
> > Commit b686afa2 introduced the invalid apparmor rule `mount options=(rw, runbindable) /,` since runbindable mount rules cannot have a source.
> > Therefore running aa-logprof/aa-genprof will trigger errors (see https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685)
> >
> > $ sudo aa-logprof
> > ERROR: Operation {'runbindable'} cannot have a source. Source = AARE('/')
>
> Oops, right, I didn't actually drop the source specification there. :(
> Thanks for fixing this.
After investigating this issue, I found that this bug stems from the following restriction not being implemented consistently in aa-* and apparmor_parser.
$ man 2 mount
If mountflags includes one of MS_SHARED, MS_PRIVATE, MS_SLAVE, or MS_UNBINDABLE [...] The source, and filesystemtype [...] arguments are ignored.
Therefore, your rule was valid for apparmor_parser, but not for aa-logprof/aa-genprof, as explained in https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/2065685 . I proposed a fix in https://gitlab.com/apparmor/apparmor/-/merge_requests/1236 .
> I wonder why I don't see this on Debian testing with AppArmor 3.0.13
> (same on openSUSE Tumbleweed).
> Is there something in particular I should do to reproduce/check this?
These new mount features have been added recently (https://gitlab.com/apparmor/apparmor/-/merge_requests/1153/diffs#b1394545ea32622b065c679b858c2ffd63f74480_0_116) : the bug can only be triggered by apparmor 4.0+
> > This patch fixes it to the intended behavior.
> >
> > Signed-off-by: Maxime Bélair <maxime.belair@canonical.com>
> > ---
> > contrib/apparmor/abstractions/passt | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt
> > index 61ec32c..d245115 100644
> > --- a/contrib/apparmor/abstractions/passt
> > +++ b/contrib/apparmor/abstractions/passt
> > @@ -26,7 +26,7 @@
> > capability sys_ptrace,
> >
> > / r, # isolate_prefork(), isolation.c
> > - mount options=(rw, runbindable) /,
> > + mount options=(rw, runbindable) -> /,
> > mount "" -> "/",
> > mount "" -> "/tmp/",
> > pivot_root "/tmp/" -> "/tmp/",
> --
> Stefano
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-05-21 7:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-05-17 11:50 [PATCH] apparmor: Fix passt abstraction Maxime Bélair
2024-05-17 12:28 ` Stefano Brivio
2024-05-21 7:50 ` Maxime Bélair
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).