From: Stefano Brivio <sbrivio@redhat.com>
To: Cathy Hu <cahu@suse.de>
Cc: passt-dev@passt.top, Cathy Hu <cathy.hu@suse.com>
Subject: Re: [PATCH] selinux: pasta accesses /etc/resolv.conf
Date: Tue, 5 Aug 2025 14:18:50 +0200 [thread overview]
Message-ID: <20250805141850.04f1187c@elisabeth> (raw)
In-Reply-To: <20250805114323.27469-2-cahu@suse.de>
On Tue, 5 Aug 2025 13:43:24 +0200
Cathy Hu <cahu@suse.de> wrote:
> From: Cathy Hu <cathy.hu@suse.com>
>
> pasta accesses /etc/resolv.conf, which needs search permissions
>
> Adresses:
>
> ----
> time->Fri Jul 25 15:57:16 2025
> type=AVC msg=audit(1753451836.581:16831): avc: denied { search } for pid=44182 comm="pasta" name="netconfig" dev="tmpfs" ino=2449 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=system_u:object_r:net_conf_t:s0 tclass=dir permissive=0
> ----
Thanks for the patch!
I wonder a bit why, at least on current Fedora, I'm not getting these
warnings, but surely sysnet_read_config() is the right way to do this,
I didn't know about it.
It looks like passt(1) (the thing for VMs) and passt.te would have the
same problem, at least on openSUSE / SLES.
Would you mind updating your patch to also convert passt.te to
sysnet_read_config(passt_t), assuming it makes sense?
--
Stefano
next prev parent reply other threads:[~2025-08-05 12:18 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-08-05 11:43 [PATCH] selinux: pasta accesses /etc/resolv.conf Cathy Hu
2025-08-05 12:18 ` Stefano Brivio [this message]
2025-08-05 13:19 ` [PATCH v2] " Cathy Hu
2025-08-05 20:37 ` Stefano Brivio
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20250805141850.04f1187c@elisabeth \
--to=sbrivio@redhat.com \
--cc=cahu@suse.de \
--cc=cathy.hu@suse.com \
--cc=passt-dev@passt.top \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://passt.top/passt
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for IMAP folder(s).