[PATCH] apparmor: Add attach_disconnected flag to passt profile

[PATCH] apparmor: Add attach_disconnected flag to passt profile

[Hector Cao]

In isolate_prefork(), passt detaches from the host filesystem: it
pivot_root()s into an empty tmpfs and lazily unmounts the old root.
Paths to objects opened before this point, such as the listening UNIX
domain socket for the hypervisor, can't be resolved from the new
root any longer, and AppArmor sees them as disconnected paths.

The visible effect is that accept4() on the hypervisor socket fails
with EACCES once passt is sandboxed, so the guest can't connect,
and have networking functional.

Set flags=(attach_disconnected), so that disconnected paths are
attached to the root of the namespace and mediated against the
existing rules, as other sandboxing profiles (e.g. libvirt's) do.

Signed-off-by: Hector Cao <hector.cao@canonical.com>
---
 contrib/apparmor/usr.bin.passt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
index da49e37..ccc2ea9 100644
--- a/contrib/apparmor/usr.bin.passt
+++ b/contrib/apparmor/usr.bin.passt
@@ -15,7 +15,7 @@ abi <abi/4.0>,
 
 include <tunables/global>
 
-profile passt /usr/bin/passt{,.avx2} {
+profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
   include <abstractions/passt>
 
   include <abstractions/user-tmp>		# tap_sock_unix_open(),
-- 
2.53.0