From mboxrd@z Thu Jan 1 00:00:00 1970 Received: by passt.top (Postfix, from userid 1000) id D83325A026E; Fri, 02 Oct 2026 23:02:40 +0200 (CEST) From: Stefano Brivio To: passt-dev@passt.top Subject: [PATCH v2] selinux: Allow passt to use setgid and setuid capabilities in namespace Date: Fri, 2 Oct 2026 23:02:40 +0200 Message-ID: <20261002210240.2521252-1-sbrivio@redhat.com> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: E3VR3KGGLSOE56ZQRK74ZTKDGKE5U24X X-Message-ID-Hash: E3VR3KGGLSOE56ZQRK74ZTKDGKE5U24X X-MailFrom: sbrivio@passt.top X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Paul Holzinger , David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Starting from commit 7bf1595c9242 ("isolation: Don't create our userns as nobody"), we unconditionally set uidmap and gidmap in the detached user namespace. Allow that in SELinux rules. We also need to allow explicit access to the related files. While at it, add the matching class requirements in pasta.te, which I forgot (harmless as they were indirectly required, but not really correct). Link: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3a8fb909da#comment-4790590 Fixes: 71b74e924426 ("isolation: Don't create our userns as nobody") Signed-off-by: Stefano Brivio --- v2: Dropped spurious files, spotted by Paul contrib/selinux/passt.te | 7 +++++-- contrib/selinux/pasta.te | 2 +- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index 6995df8..e540473 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -23,6 +23,7 @@ require { type user_home_t; type tmpfs_t; type root_t; + type nsfs_t; # Workaround: passt --vhost-user needs to map guest memory, but # libvirt doesn't maintain its own policy, which makes updates @@ -61,7 +62,7 @@ require { type sysctl_net_t; class capability { sys_tty_config setuid setgid }; - class cap_userns { setpcap sys_admin sys_ptrace }; + class cap_userns { setpcap setgid setuid sys_admin sys_ptrace }; class user_namespace create; } @@ -104,11 +105,13 @@ allow syslogd_t self:cap_userns sys_ptrace; allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid}; -allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; +allow passt_t self:cap_userns { setgid setuid setpcap sys_admin sys_ptrace }; allow passt_t self:user_namespace create; auth_read_passwd(passt_t) +allow passt_t nsfs_t:file { open read }; + allow passt_t proc_net_t:file read; allow passt_t tmp_t:sock_file { create unlink write }; allow passt_t self:netlink_route_socket { bind create nlmsg_read read write setopt }; diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 9394f97..d0c9c32 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -87,7 +87,7 @@ require { type init_t; class capability { sys_tty_config setuid setgid }; - class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin }; + class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin setgid setuid }; class user_namespace create; # Container requires -- 2.43.0