From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=YbPwylsT; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 9793B5A0262 for ; Mon, 01 Jun 2026 23:08:29 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1780348108; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=2oZL4zj6baBTypfucLFQjELnG9Gu6UtZV2UrBFk4TFQ=; b=YbPwylsTwCDDBJ7iFGWxWx+3fL6kXRkS0cFF/jDZ1RC26QOJI2aP7jQ5tCT+wPVpSJgcKm hq95mCeYRJFO6CUMSvN1VWKV4wmZYrhToTgbR03GfpBzbQnzpME2bdBW0UVvlR5uA5aD3J BICZZd7xuw8SsJ8uLusH1b99iE+c2Rw= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-392-GAbtraeoMVufeY9mcJUbZg-1; Mon, 01 Jun 2026 17:08:26 -0400 X-MC-Unique: GAbtraeoMVufeY9mcJUbZg-1 X-Mimecast-MFC-AGG-ID: GAbtraeoMVufeY9mcJUbZg_1780348106 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-46011aa5000so749822f8f.3 for ; Mon, 01 Jun 2026 14:08:26 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780348105; x=1780952905; h=date:content-transfer-encoding:mime-version:organization:references :in-reply-to:message-id:subject:cc:to:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=2oZL4zj6baBTypfucLFQjELnG9Gu6UtZV2UrBFk4TFQ=; b=Dlg5NZuJkR1LvamcTT9f0yFG593x9nUTt9DAGyhccjBZnIN7SVAsFsVBUTN3H8fQpK k+2YMKLYSvFD/0R11AYrNqaNdiLAuwtnR2jn/TlWRe544nBMqLeE6VWXedUQfqkgIiZZ A3NyMjKP33rsi/wDpP09zZqJx+9qJftUgBdmTw8xMu64SA/l7VIF7j/ycoIk3PZsFeEY V9EAY6M2GWBQBdzM0NJodr6ZBJPcnbmyB2AMFIohPV2ek1H0y5mpAJh+RnwSb0WSHxUm Jz7vgDgl9hYy01uauYmL1syhTHt8E058UIDpMFjxZqY1upE9YF7xvERgMb72BbGmuRfd rWJA== X-Gm-Message-State: AOJu0YzOjj34xVAm4mPR03ytrNOD23pCd+1Zu4UxdzvQqMlkkScWwhqY zIUPeRCXGTIx7Y1PakRjwySjenvABylU4oZlug11ztsKA5sfbfKuiII6tJLgDgQV6t8xsAv0dgK aTg0taVOQx11NkEz40bxrU5PqsfpLHLGCKQt1qoEe7bU3OLojgX/34g== X-Gm-Gg: Acq92OH2HJJEZL1u87aofXWukc1Cp1MWEzgAfhzZDBDtMaoNG+AzRxB+W7NRmB5Iv7Y g7H5JCfJxjcZBU+pLxxjk3Sa9R9+lJjV9dKJjfjsiRnf9qMKI0aOTEJlNN6cHsAo/Ad751nac9g qJ1Ec2/wEB2+qxFYyQNmu4M/g7WKHpol2rI/Mil/LdHSoDuEDWMJCw/du++WBc40j/WiHOgQL1/ HCfbKbkh80aeLnHFIWFs3WKYgD34+0DyljXq+9CbWLsJ5EtdRxDs7tyGuzVKKlx8VI83ZwcQ+TF jxRKHFB48JPXyuzCPHAACAMNIau5+P5pRsRB925e9DEuiS0sMX8tg3b//ws7+isb093B/QxN2gB N3EoWO+ct9YSUiBKwb7Hs/lGeDBGfeVJINLWkXtwk1nM= X-Received: by 2002:adf:ea0b:0:b0:45e:f381:cd86 with SMTP id ffacd0b85a97d-45ef6b1fab5mr17937632f8f.14.1780348105435; Mon, 01 Jun 2026 14:08:25 -0700 (PDT) X-Received: by 2002:adf:ea0b:0:b0:45e:f381:cd86 with SMTP id ffacd0b85a97d-45ef6b1fab5mr17937592f8f.14.1780348104821; Mon, 01 Jun 2026 14:08:24 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [2a10:fc81:a806:d6a9::1]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-45ef357635fsm26524460f8f.33.2026.06.01.14.08.24 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2026 14:08:24 -0700 (PDT) From: Stefano Brivio To: "Bittner, Jan" Subject: Re: [PATCH] apparmor: Fix signaling issues from podman Message-ID: <20260601230820.2c4cb7dd@elisabeth> In-Reply-To: References: Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Mon, 01 Jun 2026 23:08:22 +0200 (CEST) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: 9X9bJq3NV6ww0WwIca_dU8AvROhBfg6VKAcBQsgv1uY_1780348106 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: 4ZVSL23ZK7W5643OPDZN67VLFWDGXQUB X-Message-ID-Hash: 4ZVSL23ZK7W5643OPDZN67VLFWDGXQUB X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: "passt-dev@passt.top" , Paul Holzinger X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Jan, On Thu, 28 May 2026 14:08:40 +0000 "Bittner, Jan" wrote: > This fixes a bug that causes a crash in podman. Podman uses signal to > communicate with pasta. Without this patch apparmor does not allow > podman to signal pasta and kills pasta instead. Killing pasta causes > podman to crash. You can reproduce this by starting a rootless podman > socket and starting a container via the socket using podman remote or > docker. > Links: https://bugs.launchpad.net/ubuntu/+source/passt/+bug/2154379 > > Signed-off-by: Jan Philipp Bittner > --- > contrib/apparmor/usr.bin.pasta | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta > index 56b5024..b0838de 100644 > --- a/contrib/apparmor/usr.bin.pasta > +++ b/contrib/apparmor/usr.bin.pasta > @@ -18,6 +18,9 @@ include > profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { > include > > + # Allow podman to signal pasta > + signal (receive) peer=podman, Thanks a lot for investigating this and for the patch. As we discussed on IRC: a similar issue was reported on Debian: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100135 and there it was "solved" by dropping the stub profile for Podman, which doesn't seem to be an option for Ubuntu (I'm not sure why): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100135#12 but, on the other hand, as I was arguing at: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100135#17 according to what seem to be common AppArmor practices, this rule shouldn't be part of pasta's own profile, rather be in Podman's profile, which would then include pasta's "abstraction". That way, pasta would be granted the ability to receive signals from Podman when started from Podman, but not otherwise. That is, pasta's abstraction is designed to be the minimum set of rules for all users, including stand-alone usage or others. In this case, though, the difference in permissions is minimal, and we already have plenty of workarounds in place for libvirt's policies, so it wouldn't really be that bad. If having this upstream actually helps fixing the issue for Ubuntu users and it's much more convenient than the alternative, then I think it should be merged. But if a proper Podman profile, or at least a starting point, see also: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1100135#31 is something that could be introduced relatively soon, then maybe we should go that way. And, if not, if shipping a downstream patch in Ubuntu would take a similar time and effort, I'd rather suggest to go that way, so that we avoid introducing a slightly wrong rule for others (e.g. Debian). If it's not the case, though, let me know. By the way, Paul supplied a minimal reproducer: podman unshare --rootless-netns true -- Stefano