[PATCH] apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only

[PATCH] apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only

[Stefano Brivio]

Podman overrides TMPDIR to /var/tmp, and an upcoming change in the
requires pasta to write its PID file to TMPDIR.

To support this in the AppArmor policy, we need to loosen the existing
rule restricting file writes to /tmp/ and subpaths in order to include
common alternative paths for TMPDIR: the user-tmp abstraction does
exactly this.

Reported-by: Giuseppe Scrivano <gscrivan@redhat.com>
Link: https://github.com/podman-container-tools/container-libs/pull/1207
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
 contrib/apparmor/usr.bin.passt | 3 +--
 contrib/apparmor/usr.bin.pasta | 3 +--
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
index c123a86..da49e37 100644
--- a/contrib/apparmor/usr.bin.passt
+++ b/contrib/apparmor/usr.bin.passt
@@ -18,8 +18,7 @@ include <tunables/global>
 profile passt /usr/bin/passt{,.avx2} {
   include <abstractions/passt>
 
-  # Alternatively: include <abstractions/user-tmp>
-  owner /tmp/**				w,	# tap_sock_unix_open(),
+  include <abstractions/user-tmp>		# tap_sock_unix_open(),
 						# tap_sock_unix_init(), pcap(),
 						# pidfile_open(),
 						# pidfile_write(),
diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
index 56b5024..32dfad9 100644
--- a/contrib/apparmor/usr.bin.pasta
+++ b/contrib/apparmor/usr.bin.pasta
@@ -18,8 +18,7 @@ include <tunables/global>
 profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
   include <abstractions/pasta>
 
-  # Alternatively: include <abstractions/user-tmp>
-  /tmp/**				rw,	# tap_sock_unix_open(),
+  include <abstractions/user-tmp>		# tap_sock_unix_open(),
 						# tap_sock_unix_init(), pcap(),
 						# pidfile_open(),
 						# pidfile_write(),
-- 
2.43.0