Re: Apparmor (and other) Issues

[Stefano Brivio <sbrivio@redhat.com>]

On Tue, 04 Feb 2025 08:21:53 +0000
Prafulla Giri <prafulla.giri@protonmail.com> wrote:

> type=SERVICE_START msg=audit(1738501309.082:134): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=polkit comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset"
> type=AVC msg=audit(1738501309.118:135): apparmor="DENIED" operation="file_mmap" class="file" profile="passt" name="/usr/bin/passt" pid=2030 comm="passt" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="larryboy" OUID="root"
> type=SYSCALL msg=audit(1738501309.118:135): arch=c000003e syscall=59 success=no exit=-13 a0=7faf24035fc0 a1=7faf24035210 a2=7ffc063280d0 a3=0 items=0 ppid=1964 pid=2030 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="passt" exe="/usr/bin/passt" subj=passt key=(null)ARCH=x86_64 SYSCALL=execve AUID="larryboy" UID="larryboy" GID="larryboy" EUID="larryboy" SUID="larryboy" FSUID="larryboy" EGID="larryboy" SGID="larryboy" FSGID="larryboy"
> type=PROCTITLE msg=audit(1738501309.118:135): proctitle="(null)"
> type=ANOM_ABEND msg=audit(1738501309.118:136): auid=1000 uid=1000 gid=1000 ses=1 subj=passt pid=2030 comm="passt" exe="/usr/bin/passt" sig=11 res=1AUID="larryboy" UID="larryboy" GID="larryboy"

So, it looks like passt is running as its own profile. This shouldn't
happen because the libvirt profile has an own subprofile and we should
see that in "profile" on the type=AVC line but... I just reproduced
this! Clean Debian sid install, fresh install of libvirtd:

error: internal error: Child process (passt --one-off --socket /run/user/1000/libvirt/qemu/run/passt/1-alpine-net0.socket --pid /run/user/1000/libvirt/qemu/run/passt/1-alpine-net0-passt.pid --tcp-ports 40922:22) unexpected fatal signal 11

I'll keep you posted.

> > https://archives.passt.top/passt-dev/20250203082210.2114348-1-sbrivio@redhat.com/
> > 
> > then:
> > 
> > make
> > 
> > and ./pasta --config-net --trace --pcap /tmp/dns.pcap -- nslookup
> > fsf.org
> >   
> $ ./pasta --config-net --trace --pcap /tmp/dns.pcap -- nslookup fsf.org # On Debian Trixie, dns.pcap attached
> 0.0002: No interfaces with usable IPv6 routes
> 0.0002: Failed to detect external interface for IPv6
> 0.0035: Template interface: enp1s0 (IPv4)
> 0.0035: Namespace interface: enp1s0
> 0.0035: MAC:
> 0.0035:     host: 9a:55:9a:55:9a:55
> 0.0035:     NAT to host 127.0.0.1: 192.168.100.1
> 0.0036: DHCP:
> 0.0036:     assign: 192.168.100.157
> 0.0036:     mask: 255.255.255.0
> 0.0036:     router: 192.168.100.1
> 0.0036: DNS:
> 0.0036:     192.168.100.1
> 0.0036: DNS search list:
> 0.0036:     .
> 0.0204: SO_PEEK_OFF supported
> 0.0204: TCP_INFO tcpi_snd_wnd field  supported
> 0.0205: TCP_INFO tcpi_bytes_acked field  supported
> 0.0205: TCP_INFO tcpi_min_rtt field  supported
> 0.0205: Saving packet capture to /tmp/dns.pcap
> 0.0281: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001)
> 0.0413: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001)
> 0.0414: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001)
> 0.0414: tap: protocol 17, 192.168.100.157:56205 -> 192.168.100.1:53 (1 packet)
> 0.0415: Flow 0 (NEW): FREE -> NEW
> 0.0415: Flow 0 (INI): NEW -> INI
> 0.0415: Flow 0 (INI): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => ?
> 0.0416: Flow 0 (TGT): INI -> TGT
> 0.0416: Flow 0 (TGT): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => HOST [0.0.0.0]:56205 -> [192.168.100.1]:53
> 0.0416: Flow 0 (UDP flow): TGT -> TYPED
> 0.0416: Flow 0 (UDP flow): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => HOST [0.0.0.0]:56205 -> [192.168.100.1]:53
> 0.0417: Flow 0 (UDP flow): Side 0 hash table insert: bucket: 121236
> 0.0417: Flow 0 (UDP flow): TYPED -> ACTIVE
> 0.0417: Flow 0 (UDP flow): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => HOST [0.0.0.0]:56205 -> [192.168.100.1]:53
> 0.3059: pasta: epoll event on UDP reply socket 96 (events: 0x00000001)
> 0.3059: Flow 0 (UDP flow): Received 1 datagrams on reply socket
> Server:		192.168.100.1
> Address:	192.168.100.1#53
> 
> Non-authoritative answer:
> Name:	fsf.org
> Address: 209.51.188.174

Okay, at least the DNS issue is fixed. I'll apply the fix in a moment,
it will be available in an updated package in a while.

-- 
Stefano