[PATCH] apparmor: Fix signaling issues from podman

[PATCH] apparmor: Fix signaling issues from podman

[Bittner, Jan]

[-- Attachment #1: Type: text/plain, Size: 1195 bytes --]

This fixes a bug that causes a crash in podman. Podman uses signal to
communicate with pasta. Without this patch apparmor does not allow
podman to signal pasta and kills pasta instead. Killing pasta causes
podman to crash. You can reproduce this by starting a rootless podman
socket and starting a container via the socket using podman remote or
docker.
Links: https://bugs.launchpad.net/ubuntu/+source/passt/+bug/2154379

Signed-off-by: Jan Philipp Bittner <jan.bittner@kdo.de>
---
 contrib/apparmor/usr.bin.pasta | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta
index 56b5024..b0838de 100644
--- a/contrib/apparmor/usr.bin.pasta
+++ b/contrib/apparmor/usr.bin.pasta
@@ -18,6 +18,9 @@ include <tunables/global>
 profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) {
   include <abstractions/pasta>

+  # Allow podman to signal pasta
+  signal (receive) peer=podman,
+
   # Alternatively: include <abstractions/user-tmp>
   /tmp/**                              rw,     # tap_sock_unix_open(),
                                                # tap_sock_unix_init(), pcap(),
--
2.43.0

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 9516 bytes --]