Re: Apparmor (and other) Issues

[Prafulla Giri <prafulla.giri@protonmail.com>]

On Monday, February 17th, 2025 at 1:22 PM, Stefano Brivio <sbrivio@redhat.com> wrote:

> 
> You mean 'passt', and:
> 
Strangely enough, I did mean pasta: that's the one that gives a shell. passt only creates namespace thingy. I thought pasta used passt underneath and that is why changes to passt was visible by testing pasta. Am I doing something wrong?

> 
> https://salsa.debian.org/sbrivio/passt/-/commit/5bb812e79143670a57440cd8aa7f2979583c5a0a
> 
> might explain it. You need to create hard links ('make install' doesn't
> do that) to associate different AppArmor profiles.
> 
> In any case, I'm releasing (and packaging) a new version with the
> AppArmor workaround today.
> 
I just checked on Debian Sid and I can confirm that everything is working as expected. Thank you very much for your hard work. As I understand it, a better Apparmor fix is being discussed with other maintainers in the meantime. But as things stand right now, Debian users ought to be able to use passt with libvirt, as expected.

In the meantime, I have noticed another error and want to ask where I ought to report it: If a VM isn't able to run, passt configs aren't cleared. I just had a VM not start because of permission errors (I resolved it), but trying to restart the VM threw a passt error saying the port being forwarded was already in use (a remnant of previous run that failed). I'll have to come up with a way to make this reproducible, of course. But it seems that on unclean exits, passt isn't being allowed to clean things up (destroy the created namespace, stop the port-forwards, etc.) Perhaps I ought to report this on libvirt side? I encountered this error through virt-manager. Perhaps I should test with virsh as well.