From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: passt.top; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: passt.top; dkim=pass (1024-bit key; unprotected) header.d=redhat.com header.i=@redhat.com header.a=rsa-sha256 header.s=mimecast20190719 header.b=Cb6euyLA; dkim-atps=neutral Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by passt.top (Postfix) with ESMTPS id 1605B5A061A for ; Fri, 02 Oct 2026 12:13:16 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1790935995; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=XgkoWYP5925AkucXDBv758sQh5C7N4ocdRgsuJZUXAo=; b=Cb6euyLAOfunLHVcLvDbSlXQq6pPBmVCRdIas7ixcvMi20Y54cGNDMwqYe3MGOUFHDMpLw V7oqJCu2sLuHf2EHFouJrkAdiXIrLh0C31W4+QyR7k1/gqlTbUKennALC9tgF1A009OFXI y9Bw3ECJGjky/s/gHiQVOVpZOshRITQ= Received: from mail-wr1-f69.google.com (mail-wr1-f69.google.com [209.85.221.69]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-67-Jz7ySB4MP42j0Pg9RcO-Dg-1; Fri, 02 Oct 2026 06:13:14 -0400 X-MC-Unique: Jz7ySB4MP42j0Pg9RcO-Dg-1 X-Mimecast-MFC-AGG-ID: Jz7ySB4MP42j0Pg9RcO-Dg_1790935993 Received: by mail-wr1-f69.google.com with SMTP id ffacd0b85a97d-486f1ecf9bbso2472035f8f.0 for ; Fri, 02 Oct 2026 03:13:14 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790935993; x=1791540793; h=content-transfer-encoding:content-type:in-reply-to:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=XgkoWYP5925AkucXDBv758sQh5C7N4ocdRgsuJZUXAo=; b=clyaVzml4YWGAYUFoJ9wUcLc5pdJlIpiNX6B2x5nCu0xgKtSEc99tthEU6yO8hhd9t qzWjekfNQ6qybbe6DvxBayEuvDNo36bOHxNk7aeMjxoGKMleaKAnyLY6gEZ9xlvDgXap Xelg7dr5N0jRntefq1gMn3a3OYBHJBNW7UIZMK6BLUS8dyPjEDWXSCE+cyXrbP88RcLs ENsbz0CrELQzysd/SGSGv8aqqPKx/iP9tqcmKmsY3GUhf+EMYV3V13Xhumz6hlLdX8J+ Wr/wVRApHXywBi99vgNSDrc/heuYOMQM2p0TRjPD7HOtWU/PRygr8GJz3O9r/vcH1ncM tneQ== X-Forwarded-Encrypted: i=1; AKwUvBx+X552JNuHseu10fSMGFzIeGPqRUgS0Vupu+N0za56Wim/PH2X/WKtA86UrsmLXfn4TSA5A9a83sA=@passt.top X-Gm-Message-State: AFq9FYJb9rtId8AtOx2YRdC0fMdrZ9q79C5EZazGTxc8djJVtZUs4i89 hzI0lquHW5MvPguyEoRE2MO2fgGaq0/B26tt0z0wZSC7ygGZqpQS6Aeyk4kEifHkgYmH3WmzR8e L+eOh28tvURKRmuu8zhNWLsT/Km6jFSiEbrZxm4NOT4kLZmnhtRTs4pMi1r3RMA== X-Gm-Gg: AYBFou0z3XCPVXsfxBAgRQ+QPe01iV/HswSqiCiPujiyWP69H9wcuG0ZaYg0mImQyT7 +SxnaJkiUtv7Jd/68ct5KlIuhKvATKA1gGgiktzveJIDpucpDzeDSdkGVkUjDmZjzh4aMzYYJIw urvLwgAUGtsWtqjAf1dPVm3zL1vU6g9i2myNtf0L4aPZG5gOhSTeBhvVxA+TtMtvGIw1D2w1ka/ JrtRNOMAendSa5zXEycR0HDp7ECHG8VhQ/WzJr+6qiX30uD40JeRJDtpbV+gW+A1ARXFXSDaBdd 8ZLlr75mBqY8T8b4EKruA4OUv89dVRbmwVLXnxcHq4aWpAY02Cn5pznsKIuixwCau7EAp/S1IT5 yVvGU X-Received: by 2002:a05:6000:25c8:b0:488:77bc:a741 with SMTP id ffacd0b85a97d-48b12732b06mr3853475f8f.51.1790935993319; Fri, 02 Oct 2026 03:13:13 -0700 (PDT) X-Received: by 2002:a05:6000:25c8:b0:488:77bc:a741 with SMTP id ffacd0b85a97d-48b12732b06mr3853430f8f.51.1790935992852; Fri, 02 Oct 2026 03:13:12 -0700 (PDT) Received: from [192.168.188.22] ([80.243.52.133]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48b382f8c4asm4688276f8f.37.2026.10.02.03.13.11 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 02 Oct 2026 03:13:11 -0700 (PDT) Message-ID: <62775387-4e00-43c6-9ce8-6ea5da4616c9@redhat.com> Date: Fri, 2 Oct 2026 12:13:10 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] selinux: Allow passt to use setgid and setuid capabilities in namespace To: Stefano Brivio , passt-dev@passt.top References: <20261002070045.2065145-1-sbrivio@redhat.com> From: Paul Holzinger In-Reply-To: <20261002070045.2065145-1-sbrivio@redhat.com> X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: Zlru2x0gdGugDASJC2O9-j3shCW6xfwDNpPkKG1PnjE_1790935993 X-Mimecast-Originator: redhat.com Content-Language: en-US Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Message-ID-Hash: UN27XNLSF4NTLN7XQNYEYWH5XOJMYF4G X-Message-ID-Hash: UN27XNLSF4NTLN7XQNYEYWH5XOJMYF4G X-MailFrom: pholzing@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: David Gibson X-Mailman-Version: 3.3.8 Precedence: list List-Id: Development discussion and patches for passt Archived-At: Archived-At: List-Archive: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: On 02/10/2026 09:00, Stefano Brivio wrote: > Starting from commit 7bf1595c9242 ("isolation: Don't create our userns > as nobody"), we unconditionally set uidmap and gidmap in the detached > user namespace. > > Allow that in SELinux rules. We also need to allow explicit access to > the related files. > > While at it, add the matching class requirements in pasta.te, which I > forgot (harmless as they were indirectly required, but not really > correct). > > Link: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3a8fb909da#comment-4790590 > Fixes: 71b74e924426 ("isolation: Don't create our userns as nobody") > Signed-off-by: Stefano Brivio > --- > ...pen-permissions-on-netns-directory-o.patch | 72 +++++ > contrib/selinux/passt.te | 7 +- > contrib/selinux/pasta.te | 2 +- > contrib/selinux/pasta.te.orig | 266 ++++++++++++++++++ > 4 files changed, 344 insertions(+), 3 deletions(-) > create mode 100644 contrib/selinux/0001-selinux-Enable-open-permissions-on-netns-directory-o.patch > create mode 100644 contrib/selinux/pasta.te.orig I assume these two new files are not meant to be committed/part of this patch?