From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=fail (p=quarantine dis=none) header.from=redhat.com Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by passt.top (Postfix) with ESMTPS id 5A4FD5A0265 for ; Sat, 14 Nov 2026 13:47:34 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1794660453; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=9dRzQkRFmd5B5ukErrbRILSduNp/Hh5VeyYEB3h0Xao=; b=PLvpcOhsmxDZjHmiMG3xxj66+RXuKCf/+XEUHkC4fW3v6RtJcsqsKWRbEyboEBQuhOsGHN fxWcqZUJUXDXr271IpBLb8mBibA3SzubnTSgx5TWccsUhFFspxzzu4fJsC8CVu/FgQawZV Kjc0uW/UUkyfTId+Ure6QskUR7tfb6A= Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-218-6_Tg5zxqMP6IQVtBmxzgHA-1; Sat, 14 Nov 2026 07:47:32 -0500 X-MC-Unique: 6_Tg5zxqMP6IQVtBmxzgHA-1 X-Mimecast-MFC-AGG-ID: 6_Tg5zxqMP6IQVtBmxzgHA_1794660451 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-48e00f3929bso40421f8f.0 for ; Sat, 14 Nov 2026 04:47:31 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794660451; x=1795265251; h=date:content-transfer-encoding:content-type:mime-version :organization:references:in-reply-to:message-id:subject:cc:to:from :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=9dRzQkRFmd5B5ukErrbRILSduNp/Hh5VeyYEB3h0Xao=; b=cQDvW1f2/TBZwFzF16eYGhi8lmoqJmcaNy18xhAvS63rDN4WPaCybpXbhQ7Da0Z7V4 VQj0AJtse1gMq5N0c94cpsFDqv+ZBoMxwdWWGuIq8QK+V/8sdfIw7J7XKAV1H607qUb+ zzqA4HUm3seB4zw9N0yVd0OKjTKaFeMmvGGB0dklCfFVNLOWopj24l9lcydnO4daxzLB zC5s4v1h0bOEx1r/Cadb35Mmv0D/dE0nuJavdJ3rMMSCZN3RAdYhgja5Gn98Xj3H0RKM fUgIhOnXhGAzuALTq6+7WKzJBsAhinx6i8fZEI+bjlbBTkKTSK01/HYZjquGLe8H0pju znqw== X-Gm-Message-State: APuU4Z9wY6IFuP5nU7rl6zdjsUZGhrllTD7X+E8pJLWjlUsUy4M+ykGZ buu8n5KGjhfsrQZ+aG+KGUy/K+sezo5a58RZVgoggCOz+L+LxTeUt+bHiE2/aZz1tgHdhiL9k1e 1d4h3KTROZ51bIHqXtJPbEuMMq9A3qz+nPFwHyU4ijTYbFWt1o4nExH7enQWgOA== X-Gm-Gg: AYBFou3qouwVKTvOvjqayzap5ePMm99lF4/SgpSW9eUwpz6mg5QG+uLCR2ZHENs1RDa yjy6jhUCYG2OovPyqrU+Fl3mZXPaBMekPPdwR1wEGn8efAg9Ms3A9zM8b0CpkpVtsgCMtNDBAbg flA8IZVH8nYgr5wEbr3zH4qM3R9qK4lkFVYcbPf0V3vnQ3E+N+UlQaEdnLPchhoocHRXvaiuXdM qzZLIxGsAjtdaD0KcQe6F6zetyyIwRB5nwo/Jkj+pe2SxE69lCQd3UDxEn2sD4f9edbfPQoqh7f fYcDIAAACpWdoGwUgk8J5CwAiJja99lWJtNc+aVJfS1CGI/eXvdvSesz7fyk1hr/3eN7xW3AxCd xKm2WRiSM/oJz0cTtx8c/J+jp+7uWATKVYpKZ8ZC6chz0rFGb22YiLV5JW6FK3tr9U4U= X-Received: by 2002:a05:600c:1144:b0:4b4:a551:681a with SMTP id 5b1f17b1804b1-4bb55a62207mr74921285e9.3.1794660450366; Sat, 14 Nov 2026 04:47:30 -0800 (PST) X-Received: by 2002:a05:600c:1144:b0:4b4:a551:681a with SMTP id 5b1f17b1804b1-4bb55a62207mr74920945e9.3.1794660449727; Sat, 14 Nov 2026 04:47:29 -0800 (PST) Received: from maya.myfinge.rs (ifcgrfdd.trafficplex.cloud. [2a10:fc81:a806:d6a9::1]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4bb55ae5299sm150141435e9.11.2026.11.14.04.47.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 14 Nov 2026 04:47:29 -0800 (PST) From: Stefano Brivio To: Hector Cao Subject: Re: [PATCH] apparmor: Add attach_disconnected flag to passt profile Message-ID: <20261114134727.76eb9245@elisabeth> In-Reply-To: <20261113120752.218502-1-hector.cao@canonical.com> References: <20261113120752.218502-1-hector.cao@canonical.com> Organization: Red Hat X-Mailer: Claws Mail 4.2.0 (GTK 3.24.49; x86_64-pc-linux-gnu) MIME-Version: 1.0 Date: Sat, 14 Nov 2026 13:47:28 +0100 (CET) X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: t1axnNK2qgJ0G2Yx89_mlUs9XkqOy7zzG6esdzhZUlk_1794660451 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Message-ID-Hash: 3IOESHOXC4455V5U643VCC6C6D7LQZ7I X-Message-ID-Hash: 3IOESHOXC4455V5U643VCC6C6D7LQZ7I X-MailFrom: sbrivio@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: passt-dev@passt.top X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Hi Hector, On Fri, 13 Nov 2026 13:07:52 +0100 Hector Cao wrote: > In isolate_prefork(), passt detaches from the host filesystem: it > pivot_root()s into an empty tmpfs and lazily unmounts the old root. > Paths to objects opened before this point, such as the listening UNIX > domain socket for the hypervisor, can't be resolved from the new > root any longer, and AppArmor sees them as disconnected paths. > > The visible effect is that accept4() on the hypervisor socket fails > with EACCES once passt is sandboxed, so the guest can't connect, > and have networking functional. > > Set flags=(attach_disconnected), so that disconnected paths are > attached to the root of the namespace and mediated against the > existing rules, as other sandboxing profiles (e.g. libvirt's) do. > > Signed-off-by: Hector Cao > --- > contrib/apparmor/usr.bin.passt | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt > index da49e37..ccc2ea9 100644 > --- a/contrib/apparmor/usr.bin.passt > +++ b/contrib/apparmor/usr.bin.passt > @@ -15,7 +15,7 @@ abi , > > include > > -profile passt /usr/bin/passt{,.avx2} { > +profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) { Thanks for the report and for the patch. Note that I already added this flag more than a month ago in commit 032f082ffad0 ("apparmor: Fixes for new user namespace detaching procedure"): https://passt.top/passt/commit/?id=032f082ffad094649066fa94822c5a78a246a766 and I see you now created trees on Ubuntu's Launchpad so I guess you can backport this from the debian/sid tracking branch instead? See: https://git.launchpad.net/ubuntu/+source/passt/commit/contrib/apparmor/usr.bin.passt?h=debian/sid&id=e05c3ae80ca0ae6a7b227ff074893fa74a59961b By the way, I added that flag as part of the fix for: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149683 and in general we tend to fix Debian bugs quite promptly: https://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=both;src=passt but it looks a bit more complicated to get them fixed in Ubuntu: https://bugs.launchpad.net/ubuntu/+source/passt and I have to say that I was trying to figure out how to make things smoother a few years ago, but then I couldn't register a Launchpad account (because my email address was already in the database as Debian maintainer) and I gave up. Eventually I got the Launchpad account with some effort but then I didn't have the change to look into it anymore. But now that I looked into your patch I saw: https://git.launchpad.net/~hectorcao/ubuntu/+source/passt/commit/?id=66f3b374796304982db143624bf83e9d6fcec267 so I take that as a good sign. :) -- Stefano