From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=DnaHEOcp; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 8D26B5A061A for ; Fri, 02 Oct 2026 12:31:15 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790937074; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=y2dCq5hEsy5FOmbkb5xwz7C9ngB5/dLa+RyG5IcupOE=; b=DnaHEOcpHHY0JBI/sZSStUK+2VzXQEQ334xZVhL84hhoN+1iF/5ba+4eC+dQ2NKbsRZQN/ B80vb/VuI62WlkqbqVL4XgVAoy0ihpTxKTqXn4bT+ZECILPCwSdykgSAKQ0DIQbbjnUazZ YL4YRiBzyNNZQ809E+3RH2YRM9alEzs= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-581-lJMtrfV7Os64EmP-Vdw4bw-1; Fri, 02 Oct 2026 06:31:13 -0400 X-MC-Unique: lJMtrfV7Os64EmP-Vdw4bw-1 X-Mimecast-MFC-AGG-ID: lJMtrfV7Os64EmP-Vdw4bw_1790937072 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-4a0023f2b97so31224715e9.2 for ; Fri, 02 Oct 2026 03:31:13 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790937072; x=1791541872; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=y2dCq5hEsy5FOmbkb5xwz7C9ngB5/dLa+RyG5IcupOE=; b=cw6RdYJ3PvtsDMSzD5nIjWbw6TsmqvN9r5q+gQvXaLYOIVn3Ya+MCzGE7dYAm+Gb5N zU6QO7AFBeYAXyeVYcJxXUucY/sBa1G39ywptDbVxey74gOfMIO/3rTE0ZwL3XYUXM9V cWbRSCljIYYBAfGZ4brPu+KdhQS5xVk8SToG/Uhd37aQX3qrA3v8oVJQT8pSxxgWF2Oa VvZVGHXg+xMWUmy7YrKrYCFD1XOwvGhOUfn5MjLlghpznsvtrO+OMIUey7FW9FlsAL7E R394oSZ5NTNL9tZr0fk2vjQNjmpypSyJB9B5FhWTSo96NVNChd649sCrVFWHYTfV3FiW DKxg== X-Gm-Message-State: AFuF++lAsYUSQzH80Nr/RRsdwkhpHf5Jp2WwU4FkFWD9ud4WKP3T2D4N NyBl8Pt6YEDw4o+4PmwTLJVfELXOAFFI/UWiCMEaA9WF/47fW+KcRdHjaHXfeUEu6uJlrmg4L2i B8eeIOZzAuu26AM91GwC0yjQC1+th//E7tSK+YiJmnUR9ECCVVaiPNQ== X-Gm-Gg: AYBFou1GF1SZGUkWBY4x+MvG5seVhWXiw4r3rxZEjbVivDL/yoyvvxGQScKYYImJYzH Kbyu9Oo/WxmMynZXRrZCVwt6WOaxHWiAXKtT9a18TXdaFGAwyBlVdvhKe5PGvTcKzg1qUtmJxXK lfxyCfoxRb3yF9TlGX5wkhkQuH1PRQTTdBAdXBHzWp9MDsTDs/2HGrhvL99K5Iksl7T6PTFUBEA VvECo6Z7kacHl3rWfByKqHkG5qD+RHlUK3Ouknjn/DGsDgwYQH3TCNuuLiIidzNXhXIsBweE/jF BRmINpBnIg5K+YF6MTeaONu734iu2BNs4rCHE1Iga/0ejMtgtmEkH7Zs+/AQ7ahZg96hiDfVO8Q genhMixQmdg== X-Received: by 2002:a05:600c:6094:b0:4a0:2488:71cc with SMTP id 5b1f17b1804b1-4a0276b2222mr35954115e9.32.1790937072032; Fri, 02 Oct 2026 03:31:12 -0700 (PDT) X-Received: by 2002:a05:600c:6094:b0:4a0:2488:71cc with SMTP id 5b1f17b1804b1-4a0276b2222mr35953665e9.32.1790937071483; Fri, 02 Oct 2026 03:31:11 -0700 (PDT) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [2a10:fc81:a806:d6a9::1]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a0394e6c5asm50072735e9.2.2026.10.02.03.31.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Oct 2026 03:31:10 -0700 (PDT) From: Stefano Brivio To: Paul Holzinger Subject: Re: [PATCH] selinux: Allow passt to use setgid and setuid capabilities in namespace Message-ID: <20261002123109.37bc2e32@elisabeth> In-Reply-To: <62775387-4e00-43c6-9ce8-6ea5da4616c9@redhat.com> References: <20261002070045.2065145-1-sbrivio@redhat.com> <62775387-4e00-43c6-9ce8-6ea5da4616c9@redhat.com> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Fri, 02 Oct 2026 12:31:10 +0200 (CEST) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: bZx1seNjj4pZT9lfPpmoDNsZr0n4a1lmAWQ4qBwmgno_1790937072 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: OAD3CCJB2BG46XX5O47QFUTE6Y37CXDB X-Message-ID-Hash: OAD3CCJB2BG46XX5O47QFUTE6Y37CXDB X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top, David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On Fri, 2 Oct 2026 12:13:10 +0200 Paul Holzinger wrote: > On 02/10/2026 09:00, Stefano Brivio wrote: > > Starting from commit 7bf1595c9242 ("isolation: Don't create our userns > > as nobody"), we unconditionally set uidmap and gidmap in the detached > > user namespace. > > > > Allow that in SELinux rules. We also need to allow explicit access to > > the related files. > > > > While at it, add the matching class requirements in pasta.te, which I > > forgot (harmless as they were indirectly required, but not really > > correct). > > > > Link: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3a8fb909da#comment-4790590 > > Fixes: 71b74e924426 ("isolation: Don't create our userns as nobody") > > Signed-off-by: Stefano Brivio > > --- > > ...pen-permissions-on-netns-directory-o.patch | 72 +++++ > > contrib/selinux/passt.te | 7 +- > > contrib/selinux/pasta.te | 2 +- > > contrib/selinux/pasta.te.orig | 266 ++++++++++++++++++ > > 4 files changed, 344 insertions(+), 3 deletions(-) > > create mode 100644 contrib/selinux/0001-selinux-Enable-open-permissions-on-netns-directory-o.patch > > create mode 100644 contrib/selinux/pasta.te.orig > I assume these two new files are not meant to be committed/part of this > patch? Oops, yes, thanks for catching that! -- Stefano