From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=fail (p=reject dis=none) header.from=canonical.com Received: from smtp-relay-canonical-1.canonical.com (smtp-relay-canonical-1.canonical.com [185.125.188.121]) by passt.top (Postfix) with ESMTPS id 4C1ED5A061C for ; Fri, 13 Nov 2026 13:07:54 +0100 (CET) Received: from hector-pc (2.general.hector.uk.vpn [10.172.192.135]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-canonical-1.canonical.com (Postfix) with ESMTPSA id 9ADD23F077 for ; Fri, 13 Nov 2026 12:07:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20251003; t=1794571673; bh=VIDxw+9VX4mcYgdRbOjIJZJrFVMQeDLsvxa/5RdMEZQ=; h=From:To:Subject:Date:Message-ID:MIME-Version; b=A22sWoJ94nQ2vtR6mAoC39mbNPxIslMd4Uk1K86j95Lx2RIMQy8n17NnQ2tUxjhVA Rc5ErS/uQplqy1Yi9TtThwZydsa+XYwsEAVy4ncx3aBTOuFehRSuUzaggY51jPip0B iH3YQ3Vn0HwzTBF1P70wa6tKIvljoH6Ttza/JtJCXLbn6VcVkRd8cykxi6W1szJvb6 vFd4+iOP242fuBwd8o1cvx4j6t04Atw+GyGu3xHO+q8XP6e9/Zaf/GDCsU7PCmewIV DkM7bN8CRQ79O3cWY1BxGVFQUnz8wEszpvxjVIxaGzfC6KZSVNDMGhbyGrQrF+VBtm RzmlNSlnl1oGOatdSKBWx1vYCX2AvRwBWdseESQlh1pWQpzqtVip/MDOuZ9RmWZ4Nh hG4C7zcPJ9UONblDCAlZir/RjOrPeB5h+1PTBWeLXTCjkS6Yy0IPQe2FuN0fqilzvr aF/GktCVxwjo6tMK3GJGPJSBLtaVirzRDy6FpAKLMRt2IlTt9r+qfervcdi4EcSV02 pdyw/AHcqp7jQsfDV20VrCkUtbtA63UzRIRHGzqWSjuo1x5jZMssC/l6ks2LwCVKlr NXe2dpkx5jRbe0ht6R8WBYumqyQPHLlxrMOIlKCc1bPCQriD6eYlyqzT18guumrdgK 8V4dOuizpwre6ZulPUQ5hSQg= From: Hector Cao To: passt-dev@passt.top Subject: [PATCH] apparmor: Add attach_disconnected flag to passt profile Date: Fri, 13 Nov 2026 13:07:52 +0100 Message-ID: <20261113120752.218502-1-hector.cao@canonical.com> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-MailFrom: hector.cao@canonical.com X-Mailman-Rule-Hits: nonmember-moderation X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation Message-ID-Hash: IKQU5JNWHNBKG4IFOKSK3L55N7S7NW6N X-Message-ID-Hash: IKQU5JNWHNBKG4IFOKSK3L55N7S7NW6N X-Mailman-Approved-At: Fri, 13 Nov 2026 14:07:20 +0100 X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: In isolate_prefork(), passt detaches from the host filesystem: it pivot_root()s into an empty tmpfs and lazily unmounts the old root. Paths to objects opened before this point, such as the listening UNIX domain socket for the hypervisor, can't be resolved from the new root any longer, and AppArmor sees them as disconnected paths. The visible effect is that accept4() on the hypervisor socket fails with EACCES once passt is sandboxed, so the guest can't connect, and have networking functional. Set flags=(attach_disconnected), so that disconnected paths are attached to the root of the namespace and mediated against the existing rules, as other sandboxing profiles (e.g. libvirt's) do. Signed-off-by: Hector Cao --- contrib/apparmor/usr.bin.passt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index da49e37..ccc2ea9 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -15,7 +15,7 @@ abi , include -profile passt /usr/bin/passt{,.avx2} { +profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) { include include # tap_sock_unix_open(), -- 2.53.0