From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=QefP8g5r; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id AB8815A026E for ; Fri, 02 Oct 2026 07:24:49 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790918688; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xXB1hgGg+ye/nyEhd9KVJjJTMRN//HLdZ8hzY97NEgY=; b=QefP8g5rzTxHFtD0TwPONxQ3idXTR6gfrg1pL5f6Hr/XIfYLV89dMHaqxtAhvgHIbl6j9k 0JeAANAZQz1vWZcaALcTqRRYuZhgUXwC7C+grq8HOEkBMjPYe69ZbrBlj6dcBtrkwEXHED 0noS/bZIqKEWEPBbVeS+REmqefeIJK4= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-375-1dHPqrXHNlOMpYLPnjQ82A-1; Fri, 02 Oct 2026 01:24:47 -0400 X-MC-Unique: 1dHPqrXHNlOMpYLPnjQ82A-1 X-Mimecast-MFC-AGG-ID: 1dHPqrXHNlOMpYLPnjQ82A_1790918686 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-4a0761224e1so3268345e9.0 for ; Thu, 01 Oct 2026 22:24:47 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790918686; x=1791523486; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=xXB1hgGg+ye/nyEhd9KVJjJTMRN//HLdZ8hzY97NEgY=; b=z1dOknRo6kjGwwu2eLSUSZURlDvlpFBv+cQWcu6APXgAFep0PA8UDdZAegoMNUKFS4 sYHo7cthIt3sjWXBHrwFCmumoM5dfm/zHtwH0DPXY1cv2abE0dXxdajTCDo0Jf1csqEn 4D9Y708f+Fr+TjOmTGpvH/wrueRM0IYeu8xoTnXyp/j+IOYe3K5Is4pRRUb8Pcfc9Z6o A76sEPIZe0Tym/Yf68LZHcJ4VcVFYuQWVgoFXoaCqu2gL0I5fHMqcwmvdxpRF6WVkPH3 Z9aW9kfTsksTNYryPPJtDEEEm+IXnuKcMvsyyCvmmrTcw1bWBTobUrHm+hNnkx2JLkk1 ewSw== X-Gm-Message-State: AFuF++lXxNYHrOjbdwwRQTziJhWhGMmVOnWqFXGN/Nlj7coVsEq+W1Eo 457BbOCnSSrfHYU/YwSPwe1DswCvy3YyqFaDrR3T1xk/FQwkyE1R5F1CCymVu+5OdH11lJpc4wB DtilFOYQMyA7wTTpdLFVk208XMvWHIasE8My1Vv/LceBLkB4ZAyIxxFvERsxO0oBiD2e+ICNXYV iBwJPP8TCVPaIBOES7BpoQB5b85WGb8a30VTJE X-Gm-Gg: AYBFou0dnSZ2nZD2uz8GKEat0s5RaTw/qz0WGZdK6ou2QZi2MxvLvXMISqqlDNju6fC xXEgUjURJcpup582LasLoxwakLuk+swe83QatzCuHyex5qdToTDeFm9ZBd9+Ii2ocRfVj3BbXDw QOelJ85pghD/oA6m+RjxDHEPft+ez+4UVi69iljnO7jNTgwiqyL2+QmpAqVMc7TtU9sbJ9QacZd eqphlC7aKWgpRIQtMFBXV8V6TLxyAMIgd3gn9by2KDg2qL/W8pIeArtbbpgl218Rkgf6lQjh6jE 1+xLMn6wwufGBO+DM7v5mIfIPMTIehLN0GgSRQPaQgVvZgVA2auaoXmgdjBMj27e0OTTpN3w9rO wTI23PrnY+4slDchVNYJTwMG4KPA= X-Received: by 2002:a05:600c:4e04:b0:4a0:22d5:908c with SMTP id 5b1f17b1804b1-4a02759f90fmr30369005e9.12.1790918686025; Thu, 01 Oct 2026 22:24:46 -0700 (PDT) X-Received: by 2002:a05:600c:4e04:b0:4a0:22d5:908c with SMTP id 5b1f17b1804b1-4a02759f90fmr30368515e9.12.1790918685402; Thu, 01 Oct 2026 22:24:45 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [176.103.220.4]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48b382f9ae1sm3104577f8f.39.2026.10.01.22.24.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 01 Oct 2026 22:24:44 -0700 (PDT) From: Stefano Brivio To: Paul Holzinger Subject: Re: [PATCH] apparmor: allow netns paths on /tmp again Message-ID: <20261002072443.0a7e4130@elisabeth> In-Reply-To: <20261001125528.78194-2-pholzing@redhat.com> References: <20261001125528.78194-2-pholzing@redhat.com> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Fri, 02 Oct 2026 07:24:44 +0200 (CEST) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: B2PWxUK3jN8ojSFMSJ3PyPkdiaRLOwMunJ8iQLUhB0w_1790918686 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: X6MLMPTGDBTSGKZCANQT6U2VN5L63T3E X-Message-ID-Hash: X6MLMPTGDBTSGKZCANQT6U2VN5L63T3E X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Thu, 1 Oct 2026 14:55:29 +0200 Paul Holzinger wrote: > The change to the user-tmp abstraction broke pasta as it can no longer > open the netns path given by podman when it is under /tmp. > > The abstraction uses "owner" while the kernel always seems to report > ouid=0 for the bind mounted netns reference. I originally fixed that > in commit 6cdc9fd51bf6 ("apparmor: allow netns paths on /tmp"). > > In order to fix the regression add /tmp explicitly again here while > keeping the abstraction to still allow /var/tmp for the other regular > files. > > Link: https://github.com/podman-container-tools/podman/pull/29867#pullrequestreview-5378330040 > Fixes: f2683d14802d ("apparmor: Use user-tmp abstraction, allow /var/tmp instead of /tmp only") > Signed-off-by: Paul Holzinger Applied (replaced spaces with tabs, reworded comment slightly), thanks, and sorry for breaking this. -- Stefano