From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id 2B7425A026E; Fri, 25 Sep 2026 22:59:46 +0200 (CEST) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH] apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only Date: Fri, 25 Sep 2026 22:59:46 +0200 Message-ID: <20260925205946.1980078-1-sbrivio@redhat.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: PAP74YJ2XAYODSCOIEA3YV5CQTAED52B X-Message-ID-Hash: PAP74YJ2XAYODSCOIEA3YV5CQTAED52B X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Giuseppe Scrivano , =?UTF-8?q?Jan=20Rod=C3=A1k?= X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Podman overrides TMPDIR to /var/tmp, and an upcoming change in the requires pasta to write its PID file to TMPDIR. To support this in the AppArmor policy, we need to loosen the existing rule restricting file writes to /tmp/ and subpaths in order to include common alternative paths for TMPDIR: the user-tmp abstraction does exactly this. Reported-by: Giuseppe Scrivano Link: https://github.com/podman-container-tools/container-libs/pull/1207 Signed-off-by: Stefano Brivio --- contrib/apparmor/usr.bin.passt | 3 +-- contrib/apparmor/usr.bin.pasta | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index c123a86..da49e37 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -18,8 +18,7 @@ include profile passt /usr/bin/passt{,.avx2} { include - # Alternatively: include - owner /tmp/** w, # tap_sock_unix_open(), + include # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 56b5024..32dfad9 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -18,8 +18,7 @@ include profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include - # Alternatively: include - /tmp/** rw, # tap_sock_unix_open(), + include # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), -- 2.43.0