apparmor blocks passt running podman

apparmor blocks passt running podman

[hamish-passt]

Hi,

I have podman 5.1.0 and passt 0.0+20240523.765eb0bf running on Debian 
bookworm (via unofficial packages).

When I try to run podman using passt for networking, it is blocked by 
apparmor (3.0.8).

audit: type=1400 audit(1717756950.285:65): apparmor="DENIED" 
operation="open" profile="passt" 
name="/run/user/1000/netns/netns-cad489f7-d3c4-7730-9d15-17ae8e172da4" 
pid=246135 comm="passt.avx2" requested_mask="r" denied_mask="r" 
fsuid=1000 ouid=0

I'm not familiar with apparmor so I don't know how to debug this. The 
installed apparmor profile files match the ones in the pasta git. Can 
you help?

thanks,

Hamish

Re: apparmor blocks passt running podman

[Stefano Brivio]

Hi Hamish,

On Fri, 7 Jun 2024 20:45:39 +1000
hamish-passt@moffatt.email wrote:

> Hi,
> 
> I have podman 5.1.0 and passt 0.0+20240523.765eb0bf running on Debian 
> bookworm (via unofficial packages).
> 
> When I try to run podman using passt for networking, it is blocked by 
> apparmor (3.0.8).
> 
> audit: type=1400 audit(1717756950.285:65): apparmor="DENIED" 
> operation="open" profile="passt" 
> name="/run/user/1000/netns/netns-cad489f7-d3c4-7730-9d15-17ae8e172da4" 
> pid=246135 comm="passt.avx2" requested_mask="r" denied_mask="r" 
> fsuid=1000 ouid=0
> 
> I'm not familiar with apparmor so I don't know how to debug this. The 
> installed apparmor profile files match the ones in the pasta git. Can 
> you help?

Thanks for your report.

I think the issue is caused by the fact that, with the package you're
using, pasta is associated with the "passt" profile, which is the
profile for passt(1) mode, instead of the usr.bin.pasta profile: look
at the "profile" string in the AppArmor message you shared.

I fixed this in the official Debian packages here, a while ago:
  https://salsa.debian.org/sbrivio/passt/-/commit/5bb812e79143670a57440cd8aa7f2979583c5a0a

Which unofficial packages are you using?

On Debian Bookworm, I think you could simply use the official version
from testing, 0.0~git20240523.765eb0b-1, see also:
  https://tracker.debian.org/pkg/passt

-- 
Stefano