1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
| | # SPDX-License-Identifier: AGPL-3.0-or-later
#
# PASTA - Pack A Subtle Tap Abstraction
# for network namespace/tap device mode
#
# contrib/apparmor/usr.bin.pasta - AppArmor profile example/template for pasta
#
# Copyright (c) 2022 Red Hat GmbH
# Author: Stefano Brivio <sbrivio@redhat.com>
abi <abi/3.0>,
include <tunables/global>
/usr/bin/pasta flags=(attach_disconnected) {
include <abstractions/base> # Interactive shell
include <abstractions/nameservice>
include <abstractions/consoles>
include <abstractions/bash>
owner /proc/**/ns/user r,
/ r,
capability sys_ptrace, # bash
capability dac_read_search,
capability dac_override,
@{etc_ro}/** r,
/usr/** r,
/lib/** r,
owner @{HOME}/** rw,
owner /tmp/** rw,
/proc/*/net/tcp r, # procfs_scan_listen(), util.c
/proc/*/net/tcp6 r,
/proc/*/net/udp r,
/proc/*/net/udp6 r,
/dev/net/tun rw, # tap_ns_tun(), tap.c
capability net_admin, # for network namespace only
capability setpcap, # drop_caps(), util.c
capability sys_admin, # sandbox(), passt.c
mount "" -> "/", # sandbox(), passt.c
mount "" -> "/tmp/",
pivot_root "/tmp/" -> "/tmp/",
umount "/",
network netlink raw, # netlink.c
network inet stream, # tcp.c
network inet6 stream,
network inet dgram, # udp.c
network inet6 dgram,
network unix stream, # tap.c
network unix dgram, # __openlog(), util.c
owner /proc/*/gid_map w, # pasta_setup_ns()
owner /proc/*/setgroups w,
owner /proc/*/uid_map w,
owner /proc/sys/net/ipv4/ping_group_range w,
/{usr/,}bin/** mrix, # spawning shell
/usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c
}
|