Re: [PATCH] apparmor: Add attach_disconnected flag to passt profile

[Stefano Brivio <sbrivio@redhat.com>]

Hi Hector,

On Fri, 13 Nov 2026 13:07:52 +0100
Hector Cao <hector.cao@canonical.com> wrote:

> In isolate_prefork(), passt detaches from the host filesystem: it
> pivot_root()s into an empty tmpfs and lazily unmounts the old root.
> Paths to objects opened before this point, such as the listening UNIX
> domain socket for the hypervisor, can't be resolved from the new
> root any longer, and AppArmor sees them as disconnected paths.
> 
> The visible effect is that accept4() on the hypervisor socket fails
> with EACCES once passt is sandboxed, so the guest can't connect,
> and have networking functional.
> 
> Set flags=(attach_disconnected), so that disconnected paths are
> attached to the root of the namespace and mediated against the
> existing rules, as other sandboxing profiles (e.g. libvirt's) do.
> 
> Signed-off-by: Hector Cao <hector.cao@canonical.com>
> ---
>  contrib/apparmor/usr.bin.passt | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
> index da49e37..ccc2ea9 100644
> --- a/contrib/apparmor/usr.bin.passt
> +++ b/contrib/apparmor/usr.bin.passt
> @@ -15,7 +15,7 @@ abi <abi/4.0>,
>  
>  include <tunables/global>
>  
> -profile passt /usr/bin/passt{,.avx2} {
> +profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {

Thanks for the report and for the patch.  Note that I already added
this flag more than a month ago in commit 032f082ffad0 ("apparmor:
Fixes for new user namespace detaching procedure"):

  https://passt.top/passt/commit/?id=032f082ffad094649066fa94822c5a78a246a766

and I see you now created trees on Ubuntu's Launchpad so I guess you
can backport this from the debian/sid tracking branch instead? See:

  https://git.launchpad.net/ubuntu/+source/passt/commit/contrib/apparmor/usr.bin.passt?h=debian/sid&id=e05c3ae80ca0ae6a7b227ff074893fa74a59961b

By the way, I added that flag as part of the fix for:

  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149683

and in general we tend to fix Debian bugs quite promptly:

  https://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=both;src=passt

but it looks a bit more complicated to get them fixed in Ubuntu:

  https://bugs.launchpad.net/ubuntu/+source/passt

and I have to say that I was trying to figure out how to make things
smoother a few years ago, but then I couldn't register a Launchpad
account (because my email address was already in the database as
Debian maintainer) and I gave up.  Eventually I got the Launchpad
account with some effort but then I didn't have the change to look
into it anymore.

But now that I looked into your patch I saw:

  https://git.launchpad.net/~hectorcao/ubuntu/+source/passt/commit/?id=66f3b374796304982db143624bf83e9d6fcec267

so I take that as a good sign. :)

-- 
Stefano