public inbox for passt-dev@passt.top
 help / color / mirror / code / Atom feed
* [PATCH] apparmor: Fix comments after PID file and AF_UNIX socket creation refactoring
@ 2024-05-23 11:19 Stefano Brivio
  2024-05-23 13:08 ` Richard W.M. Jones
  0 siblings, 1 reply; 2+ messages in thread
From: Stefano Brivio @ 2024-05-23 11:19 UTC (permalink / raw)
  To: passt-dev; +Cc: 'Richard W . M . Jones'

Now:
- we don't open the PID file in main() anymore
- PID file and AF_UNIX socket are opened by pidfile_open() and
  tap_sock_unix_open()
- write_pidfile() becomes pidfile_write()

Reported-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/apparmor/abstractions/pasta | 2 +-
 contrib/apparmor/usr.bin.passt      | 9 ++++++---
 contrib/apparmor/usr.bin.pasta      | 9 ++++++---
 3 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index 581ad1b..9f73bee 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -27,7 +27,7 @@
   @{PROC}/@{pid}/net/udp		r,
   @{PROC}/@{pid}/net/udp6		r,
 
-  @{run}/user/@{uid}/**			rw,	# pasta_open_ns(), main()
+  @{run}/user/@{uid}/**			rw,	# pasta_open_ns()
 
   @{PROC}/[0-9]*/ns/			r,	# pasta_netns_quit_init(),
   @{PROC}/[0-9]*/ns/net			r,	# pasta_wait_for_ns(),
diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
index 564f82f..9568189 100644
--- a/contrib/apparmor/usr.bin.passt
+++ b/contrib/apparmor/usr.bin.passt
@@ -19,9 +19,12 @@ profile passt /usr/bin/passt{,.avx2} {
   include <abstractions/passt>
 
   # Alternatively: include <abstractions/user-tmp>
-  owner /tmp/**				w,	# tap_sock_unix_init(), pcap(),
-						# write_pidfile(),
+  owner /tmp/**				w,	# tap_sock_unix_open(),
+						# tap_sock_unix_init(), pcap(),
+						# pidfile_open(),
+						# pidfile_write(),
 						# logfile_init()
 
-  owner @{HOME}/**			w,	# pcap(), write_pidfile()
+  owner @{HOME}/**			w,	# pcap(), pidfile_open(),
+						# pidfile_write()
 }
diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
index bdfeb71..2483968 100644
--- a/contrib/apparmor/usr.bin.pasta
+++ b/contrib/apparmor/usr.bin.pasta
@@ -19,10 +19,13 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
   include <abstractions/pasta>
 
   # Alternatively: include <abstractions/user-tmp>
-  /tmp/**				rw,	# tap_sock_unix_init(), pcap(),
-						# write_pidfile(),
+  /tmp/**				rw,	# tap_sock_unix_open(),
+						# tap_sock_unix_init(), pcap(),
+						# pidfile_open(),
+						# pidfile_write(),
 						# logfile_init(),
 						# pasta_open_ns()
 
-  owner @{HOME}/**			w,	# pcap(), write_pidfile()
+  owner @{HOME}/**			w,	# pcap(), pidfile_open(),
+						# pidfile_write()
 }
-- 
@@ -19,10 +19,13 @@ profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
   include <abstractions/pasta>
 
   # Alternatively: include <abstractions/user-tmp>
-  /tmp/**				rw,	# tap_sock_unix_init(), pcap(),
-						# write_pidfile(),
+  /tmp/**				rw,	# tap_sock_unix_open(),
+						# tap_sock_unix_init(), pcap(),
+						# pidfile_open(),
+						# pidfile_write(),
 						# logfile_init(),
 						# pasta_open_ns()
 
-  owner @{HOME}/**			w,	# pcap(), write_pidfile()
+  owner @{HOME}/**			w,	# pcap(), pidfile_open(),
+						# pidfile_write()
 }
-- 
2.43.0



^ permalink raw reply related	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2024-05-23 13:08 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-05-23 11:19 [PATCH] apparmor: Fix comments after PID file and AF_UNIX socket creation refactoring Stefano Brivio
2024-05-23 13:08 ` Richard W.M. Jones

Code repositories for project(s) associated with this public inbox

	https://passt.top/passt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).