[PATCH] pasta.te: fix demo.sh and remove one duplicate rule

[PATCH] pasta.te: fix demo.sh and remove one duplicate rule

[7ppKb5bW]

On Fedora 41, without "allow pasta_t unconfined_t:dir read" /usr/bin/pasta can't open /proc/[pid]/ns , which is required by pasta_netns_quit_init() .
This patch also remove one duplicate rule "allow pasta_t nsfs_t:file read;" , "allow pasta_t nsfs_t:file { open read };" at line 123 is enough.

---
 contrib/selinux/pasta.te | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
index 69be081..d0ff0cc 100644
--- a/contrib/selinux/pasta.te
+++ b/contrib/selinux/pasta.te
@@ -171,7 +171,7 @@ allow pasta_t init_t:lnk_file read;
 allow pasta_t init_t:unix_stream_socket connectto;
 allow pasta_t init_t:dbus send_msg;
 allow pasta_t init_t:system status;
-allow pasta_t unconfined_t:dir search;
+allow pasta_t unconfined_t:dir { read search };
 allow pasta_t unconfined_t:file read;
 allow pasta_t unconfined_t:lnk_file read;
 allow pasta_t self:process { setpgid setcap };
@@ -192,8 +192,6 @@ allow pasta_t sysctl_net_t:dir search;
 allow pasta_t sysctl_net_t:file { open read write };
 allow pasta_t kernel_t:system module_request;
 
-allow pasta_t nsfs_t:file read;
-
 allow pasta_t proc_t:dir mounton;
 allow pasta_t proc_t:filesystem mount;
 allow pasta_t net_conf_t:lnk_file read;
-- 
@@ -171,7 +171,7 @@ allow pasta_t init_t:lnk_file read;
 allow pasta_t init_t:unix_stream_socket connectto;
 allow pasta_t init_t:dbus send_msg;
 allow pasta_t init_t:system status;
-allow pasta_t unconfined_t:dir search;
+allow pasta_t unconfined_t:dir { read search };
 allow pasta_t unconfined_t:file read;
 allow pasta_t unconfined_t:lnk_file read;
 allow pasta_t self:process { setpgid setcap };
@@ -192,8 +192,6 @@ allow pasta_t sysctl_net_t:dir search;
 allow pasta_t sysctl_net_t:file { open read write };
 allow pasta_t kernel_t:system module_request;
 
-allow pasta_t nsfs_t:file read;
-
 allow pasta_t proc_t:dir mounton;
 allow pasta_t proc_t:filesystem mount;
 allow pasta_t net_conf_t:lnk_file read;
-- 

Re: [PATCH] pasta.te: fix demo.sh and remove one duplicate rule

[Stefano Brivio]

On Sun, 02 Feb 2025 19:21:21 +0000
7ppKb5bW <pONy4THS@protonmail.com> wrote:

> On Fedora 41, without "allow pasta_t unconfined_t:dir read" /usr/bin/pasta can't open /proc/[pid]/ns , which is required by pasta_netns_quit_init() .
> This patch also remove one duplicate rule "allow pasta_t nsfs_t:file read;" , "allow pasta_t nsfs_t:file { open read };" at line 123 is enough.

Applied, thanks! I didn't notice we always ended up using the netns quit
timer fallback with SELinux. :(

For the future (I hope you'll contribute more, of course!) I would
appreciate if you could tag your submissions with a "Signed-off-by"
tag, in the sense of:

  https://www.kernel.org/doc/html/latest/process/submitting-patches.html#developer-s-certificate-of-origin-1-1

contrary to the Linux kernel guidelines, we _do_ accept nicknames not
related to any "known identity" such as (presumably) yours. So
"Signed-off-by: nickname <your email>" would be entirely fine.

This change is trivial, so it's not really needed for this one.

-- 
Stefano