[PATCH] apparmor: Add attach_disconnected flag to passt profile

[PATCH] apparmor: Add attach_disconnected flag to passt profile

[Hector Cao]

In isolate_prefork(), passt detaches from the host filesystem: it
pivot_root()s into an empty tmpfs and lazily unmounts the old root.
Paths to objects opened before this point, such as the listening UNIX
domain socket for the hypervisor, can't be resolved from the new
root any longer, and AppArmor sees them as disconnected paths.

The visible effect is that accept4() on the hypervisor socket fails
with EACCES once passt is sandboxed, so the guest can't connect,
and have networking functional.

Set flags=(attach_disconnected), so that disconnected paths are
attached to the root of the namespace and mediated against the
existing rules, as other sandboxing profiles (e.g. libvirt's) do.

Signed-off-by: Hector Cao <hector.cao@canonical.com>
---
 contrib/apparmor/usr.bin.passt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
index da49e37..ccc2ea9 100644
--- a/contrib/apparmor/usr.bin.passt
+++ b/contrib/apparmor/usr.bin.passt
@@ -15,7 +15,7 @@ abi <abi/4.0>,
 
 include <tunables/global>
 
-profile passt /usr/bin/passt{,.avx2} {
+profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {
   include <abstractions/passt>
 
   include <abstractions/user-tmp>		# tap_sock_unix_open(),
-- 
2.53.0

Re: [PATCH] apparmor: Add attach_disconnected flag to passt profile

[Stefano Brivio]

Hi Hector,

On Fri, 13 Nov 2026 13:07:52 +0100
Hector Cao <hector.cao@canonical.com> wrote:

> In isolate_prefork(), passt detaches from the host filesystem: it
> pivot_root()s into an empty tmpfs and lazily unmounts the old root.
> Paths to objects opened before this point, such as the listening UNIX
> domain socket for the hypervisor, can't be resolved from the new
> root any longer, and AppArmor sees them as disconnected paths.
> 
> The visible effect is that accept4() on the hypervisor socket fails
> with EACCES once passt is sandboxed, so the guest can't connect,
> and have networking functional.
> 
> Set flags=(attach_disconnected), so that disconnected paths are
> attached to the root of the namespace and mediated against the
> existing rules, as other sandboxing profiles (e.g. libvirt's) do.
> 
> Signed-off-by: Hector Cao <hector.cao@canonical.com>
> ---
>  contrib/apparmor/usr.bin.passt | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt
> index da49e37..ccc2ea9 100644
> --- a/contrib/apparmor/usr.bin.passt
> +++ b/contrib/apparmor/usr.bin.passt
> @@ -15,7 +15,7 @@ abi <abi/4.0>,
>  
>  include <tunables/global>
>  
> -profile passt /usr/bin/passt{,.avx2} {
> +profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) {

Thanks for the report and for the patch.  Note that I already added
this flag more than a month ago in commit 032f082ffad0 ("apparmor:
Fixes for new user namespace detaching procedure"):

  https://passt.top/passt/commit/?id=032f082ffad094649066fa94822c5a78a246a766

and I see you now created trees on Ubuntu's Launchpad so I guess you
can backport this from the debian/sid tracking branch instead? See:

  https://git.launchpad.net/ubuntu/+source/passt/commit/contrib/apparmor/usr.bin.passt?h=debian/sid&id=e05c3ae80ca0ae6a7b227ff074893fa74a59961b

By the way, I added that flag as part of the fix for:

  https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149683

and in general we tend to fix Debian bugs quite promptly:

  https://bugs.debian.org/cgi-bin/pkgreport.cgi?archive=both;src=passt

but it looks a bit more complicated to get them fixed in Ubuntu:

  https://bugs.launchpad.net/ubuntu/+source/passt

and I have to say that I was trying to figure out how to make things
smoother a few years ago, but then I couldn't register a Launchpad
account (because my email address was already in the database as
Debian maintainer) and I gave up.  Eventually I got the Launchpad
account with some effort but then I didn't have the change to look
into it anymore.

But now that I looked into your patch I saw:

  https://git.launchpad.net/~hectorcao/ubuntu/+source/passt/commit/?id=66f3b374796304982db143624bf83e9d6fcec267

so I take that as a good sign. :)

-- 
Stefano