[PATCH v2] selinux: Allow passt to use setgid and setuid capabilities in namespace

[Stefano Brivio <sbrivio@redhat.com>]

Starting from commit 7bf1595c9242 ("isolation: Don't create our userns
as nobody"), we unconditionally set uidmap and gidmap in the detached
user namespace.

Allow that in SELinux rules. We also need to allow explicit access to
the related files.

While at it, add the matching class requirements in pasta.te, which I
forgot (harmless as they were indirectly required, but not really
correct).

Link: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3a8fb909da#comment-4790590
Fixes: 71b74e924426 ("isolation: Don't create our userns as nobody")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
---
v2: Dropped spurious files, spotted by Paul

 contrib/selinux/passt.te | 7 +++++--
 contrib/selinux/pasta.te | 2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te
index 6995df8..e540473 100644
--- a/contrib/selinux/passt.te
+++ b/contrib/selinux/passt.te
@@ -23,6 +23,7 @@ require {
 	type user_home_t;
 	type tmpfs_t;
 	type root_t;
+	type nsfs_t;
 
 	# Workaround: passt --vhost-user needs to map guest memory, but
 	# libvirt doesn't maintain its own policy, which makes updates
@@ -61,7 +62,7 @@ require {
 	type sysctl_net_t;
 
 	class capability { sys_tty_config setuid setgid };
-	class cap_userns { setpcap sys_admin sys_ptrace };
+	class cap_userns { setpcap setgid setuid sys_admin sys_ptrace };
 	class user_namespace create;
 }
 
@@ -104,11 +105,13 @@ allow syslogd_t self:cap_userns sys_ptrace;
 
 allow passt_t self:process setcap;
 allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid};
-allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace };
+allow passt_t self:cap_userns { setgid setuid setpcap sys_admin sys_ptrace };
 allow passt_t self:user_namespace create;
 
 auth_read_passwd(passt_t)
 
+allow passt_t nsfs_t:file { open read };
+
 allow passt_t proc_net_t:file read;
 allow passt_t tmp_t:sock_file { create unlink write };
 allow passt_t self:netlink_route_socket { bind create nlmsg_read read write setopt };
diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
index 9394f97..d0c9c32 100644
--- a/contrib/selinux/pasta.te
+++ b/contrib/selinux/pasta.te
@@ -87,7 +87,7 @@ require {
 	type init_t;
 
 	class capability { sys_tty_config setuid setgid };
-	class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin };
+	class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin setgid setuid };
 	class user_namespace create;
 
 	# Container requires
-- 
2.43.0