From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id 20A845A0271; Thu, 08 Jan 2026 15:23:35 +0100 (CET) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH] apparmor: Allow reading TCP RTO sysctl parameters Date: Thu, 8 Jan 2026 15:23:35 +0100 Message-ID: <20260108142335.3378196-1-sbrivio@redhat.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: S2PBFJ4DMTHMZTURJ62NEYXRZK5LBJBI X-Message-ID-Hash: S2PBFJ4DMTHMZTURJ62NEYXRZK5LBJBI X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Martin Pitt , Yumei Huang X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: Martin Pitt Since commits 3dde0e07804e ("tcp: Update data retransmission timeout") and 1a834879a2f7 ("tcp: Clamp the retry timeout") from 2025-12-02, passt reads additional TCP-related sysctl parameters from /proc to configure retransmission timeout behavior: - /proc/sys/net/ipv4/tcp_syn_retries - /proc/sys/net/ipv4/tcp_syn_linear_timeouts - /proc/sys/net/ipv4/tcp_rto_max_ms These are read by tcp_get_rto_params() during initialization. Adjust the AppArmor profile accordingly. Link: https://bugzilla.redhat.com/show_bug.cgi?id=2426863 Link: https://github.com/cockpit-project/bots/pull/8568 Fixes: 3dde0e07804e ("tcp: Update data retransmission timeout") Fixes: 1a834879a2f7 ("tcp: Clamp the retry timeout") Signed-off-by: Martin Pitt [sbrivio: Minor formatting change, changed commit references] Signed-off-by: Stefano Brivio --- Martin, I took the liberty to add a newline around the lines you're adding so that we need a single comment and everything is aligned. I also changed the format of commit references to what we typically use, which is inspired by the preferred format for kernel submissions, I used this one-liner: git show -s --abbrev=12 --pretty=format:"Fixes: %h (\"%s\")" "${SHA}" which actually belongs to CONTRIBUTING.md, cf. page 1241 of my to-do book. contrib/apparmor/abstractions/passt | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index 43fd63f..25b2ea8 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -36,6 +36,10 @@ @{PROC}/sys/net/ipv4/ip_local_port_range r, # fwd_probe_ephemeral() + @{PROC}/sys/net/ipv4/tcp_syn_retries r, # tcp_get_rto_params(), tcp.c + @{PROC}/sys/net/ipv4/tcp_syn_linear_timeouts r, + @{PROC}/sys/net/ipv4/tcp_rto_max_ms r, + network netlink raw, # nl_sock_init_do(), netlink.c network inet stream, # tcp.c -- 2.43.0