From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=none (p=none dis=none) header.from=danishpraka.sh Authentication-Results: passt.top; dkim=pass (2048-bit key; unprotected) header.d=danishpraka.sh header.i=@danishpraka.sh header.a=rsa-sha256 header.s=fm1 header.b=dx4bgw9i; dkim=pass (2048-bit key; unprotected) header.d=messagingengine.com header.i=@messagingengine.com header.a=rsa-sha256 header.s=fm3 header.b=H22ZRvVd; dkim-atps=neutral Received: from flow-a5-smtp.messagingengine.com (flow-a5-smtp.messagingengine.com [103.168.172.140]) by passt.top (Postfix) with ESMTPS id 9CABD5A0619 for ; Thu, 30 Oct 2025 11:49:48 +0100 (CET) Received: from phl-compute-06.internal (phl-compute-06.internal [10.202.2.46]) by mailflow.phl.internal (Postfix) with ESMTP id 93F4A1380381; Thu, 30 Oct 2025 06:49:47 -0400 (EDT) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-06.internal (MEProxy); Thu, 30 Oct 2025 06:49:47 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=danishpraka.sh; h=cc:cc:content-transfer-encoding:content-type:date:date:from :from:in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm1; t=1761821387; x= 1761828587; bh=5eSulLd37zYZ1/h4o0EiRyb2u+Aa/BPnEPJ5HQr12yg=; b=d x4bgw9i4b6tXf1b8Z0ZuMU9oM4gC5c33XK9hwVdcoe9seQC0D5ChkZKjQYYl71fg St4/qcYOJSYYA7RNRNNp4fijJZe9fAUkLZW5YBOs+F0aPMvfp1yyncoQcAC3kKd7 YqQjplxi3nr3qsbZ6kpli6QEdC891x8S4bTzJSLTlFlKbsnlELebTulC1Qnn+N4o kW+fjC/4siAp74McFTCquHCUGROzg7ZvPHT3iCMf0qm63mWrryZJ/d/uESoAGzp/ UelvFpFGRvtLyS+NmH/OFt+jLb7I5Tu+iAxoCH1IPZw6L+bsP1NMKPIZq99FYRD7 SCMOxRapAYdB5QQQx4FkA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1761821387; x=1761828587; bh=5 eSulLd37zYZ1/h4o0EiRyb2u+Aa/BPnEPJ5HQr12yg=; b=H22ZRvVdo+Nks11K7 mpRJDDwy55hFXvnsLg6g8lbamHRV/e8f4zv9tdH40VleCGW/gkxGukZt99R/nlkt uU66lXf6xF26R6Ywe3yzfViaU6BRPGoHtSST1/oKZWPdVsXDGHUrhIX43fuk5DMA MdjlPO4ivyVtzrO3Hnxun5UtBqnb6l5fPvE5TCYRuhQ7J1gFacmIBGjG9A7L5fbs OfM3EdOxGzrlotsvrOljgdI1yfWXul6l8rmoogRM3JMHzUfBxvTgGGh3hgKeOgtL YcrwXPiEuWWJ/F8QEWLq3Csw+ZLlsq7KGo76C++P993yqHQ4jAjGcze4Rtuwh0+9 yqwjQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeeffedrtdeggdduieeigeduucetufdoteggodetrf dotffvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfurfetoffkrfgpnffqhgenuceu rghilhhouhhtmecufedttdenucgorfhhihhshhhinhhgqdfgmfegfeefqddvtdculdeftd dtmdenucfjughrpefhvfevufffkffojghfggfgsedtkeertdertddtnecuhfhrohhmpeff rghnihhshhcurfhrrghkrghshhcuoegtohhnthgrtghtsegurghnihhshhhprhgrkhgrrd hshheqnecuggftrfgrthhtvghrnhepffdvueduhfelfeeuvefhtefgkeffgfehteehgfej leduiedtieeffeejgeehhfffnecuffhomhgrihhnpehprghsshhtrdhtohhpnecuvehluh hsthgvrhfuihiivgeptdenucfrrghrrghmpehmrghilhhfrhhomheptghonhhtrggtthes uggrnhhishhhphhrrghkrgdrshhhpdhnsggprhgtphhtthhopeehpdhmohguvgepshhmth hpohhuthdprhgtphhtthhopehprghsshhtqdguvghvsehprghsshhtrdhtohhppdhrtghp thhtohepshgsrhhivhhiohesrhgvughhrghtrdgtohhmpdhrtghpthhtohepghhithesmh grgigthhgvrhhnohhffhdrtggrpdhrtghpthhtohepphhhohhliihinhhgsehrvgguhhgr thdrtghomhdprhgtphhtthhopegtohhnthgrtghtsegurghnihhshhhprhgrkhgrrdhshh X-ME-Proxy: Feedback-ID: i59a6483a:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Thu, 30 Oct 2025 06:49:44 -0400 (EDT) From: Danish Prakash To: passt-dev@passt.top Subject: [PATCH v2] contrib/selinux: use regex instead of SELinux template Date: Thu, 30 Oct 2025 16:19:13 +0530 Message-ID: <20251030104925.529411-1-contact@danishpraka.sh> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251029001704.43f73a42@elisabeth> References: <20251029001704.43f73a42@elisabeth> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MailFrom: contact@danishpraka.sh X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: HMVYNHZGG37PKSC7QS4UYCY4POJG5YOV X-Message-ID-Hash: HMVYNHZGG37PKSC7QS4UYCY4POJG5YOV X-Mailman-Approved-At: Thu, 30 Oct 2025 11:54:42 +0100 CC: sbrivio@redhat.com, git@maxchernoff.ca, pholzing@redhat.com, Danish Prakash X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: It might be possible to avoid using SELinux template (%USERID), and instead using regex to match user ids. This would allow discarding the explicit restorecon call while during package builds[1]. Original suggestion from cathy.hu@suse.com: > running restorecon would be unnecessary if the passt upstream selinux > module would not use ${USERID} in pasta.fc (gets converted to [0-9]+ anyway) [1] - https://passt.top/passt/commit/?id=e019323538699967c155c29411545223dadfc0f5 Signed-off-by: Danish Prakash --- contrib/fedora/passt.spec | 11 ----------- contrib/selinux/pasta.fc | 12 ++++++------ 2 files changed, 6 insertions(+), 17 deletions(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index 663289f53d97..d1bcf4a74338 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -103,17 +103,6 @@ fi %posttrans selinux %selinux_relabel_post -s %{selinuxtype} -# %selinux_relabel_post calls fixfiles(8) with the previous file_contexts file -# (see selabel_file(5)) in order to restore only the file contexts which -# actually changed. However, as file_contexts doesn't support %{USERID} -# substitutions, this will not work for specific file contexts that pasta needs -# to have under /run/user. -# -# Restore those explicitly, hiding errors from restorecon(8): we can't pass a -# path that's more specific than this, but at the same time /run/user often -# contains FUSE mountpoints that can't be accessed as root, leading to -# "Permission denied" messages, but not failures. -restorecon -R /run/user 2>/dev/null %files %license LICENSES/{GPL-2.0-or-later.txt,BSD-3-Clause.txt} diff --git a/contrib/selinux/pasta.fc b/contrib/selinux/pasta.fc index e60c6148f412..82dbcbe2b75e 100644 --- a/contrib/selinux/pasta.fc +++ b/contrib/selinux/pasta.fc @@ -12,11 +12,11 @@ /usr/bin/pasta.avx2 system_u:object_r:pasta_exec_t:s0 /tmp/pasta\.pcap system_u:object_r:pasta_log_t:s0 /var/run/pasta\.pid system_u:object_r:pasta_pid_t:s0 -/run/user/%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 -/run/user/%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 +/run/user/[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 +/run/user/[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 # In case XDG_RUNTIME_DIR is not set (i.e. no systemd user session) Podman falls # back to a location under /tmp -/tmp/storage-run-%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 -/tmp/storage-run-%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 -/tmp/containers-user-%{USERID}/netns system_u:object_r:ifconfig_var_run_t:s0 -/tmp/containers-user-%{USERID}/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 +/tmp/storage-run-[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 +/tmp/storage-run-[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 +/tmp/containers-user-[0-9]+/netns system_u:object_r:ifconfig_var_run_t:s0 +/tmp/containers-user-[0-9]+/containers/networks/rootless-netns system_u:object_r:ifconfig_var_run_t:s0 -- 2.51.0