From e9d573b14f28bde604718513ed3d499f621090d8 Mon Sep 17 00:00:00 2001 From: Stefano Brivio Date: Sun, 27 Mar 2022 21:58:11 +0200 Subject: [PATCH] passt, pasta: Add examples of AppArmor policies These should cover any reasonably common use case in distributions. Signed-off-by: Stefano Brivio --- contrib/apparmor/usr.bin.passt | 59 ++++++++++++++++++++++++++++++ contrib/apparmor/usr.bin.pasta | 66 ++++++++++++++++++++++++++++++++++ 2 files changed, 125 insertions(+) create mode 100644 contrib/apparmor/usr.bin.passt create mode 100644 contrib/apparmor/usr.bin.pasta diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt new file mode 100644 index 0000000..a19fede --- /dev/null +++ b/contrib/apparmor/usr.bin.passt @@ -0,0 +1,59 @@ +# SPDX-License-Identifier: AGPL-3.0-or-later +# +# PASST - Plug A Simple Socket Transport +# for qemu/UNIX domain socket mode +# +# contrib/apparmor/usr.bin.passt - AppArmor profile example/template for passt +# +# Copyright (c) 2022 Red Hat GmbH +# Author: Stefano Brivio + +abi , + +include + +/usr/bin/passt { + ### Alternatively: include + @{etc_ro}/ld.so.cache r, + /{usr/,}lib{,32,64}/ld-*.so r, + /{usr/,}lib{,32,64}/libc-*.so mr, + /{usr/,}lib/@{multiarch}/ld-*.so r, + /{usr/,}lib/@{multiarch}/libc-*.so mr, + /dev/null rw, # __daemon(), util.c + signal receive set=int peer=unconfined, + signal receive set=term peer=unconfined, + ### + + ### Alternatively: include + @{etc_ro}/resolv.conf r, # get_dns(), conf.c + ### + + capability sys_admin, # sandbox(), passt.c + capability setpcap, # drop_caps(), util.c + + mount "" -> "/", # sandbox(), passt.c + mount "" -> "/tmp/", + pivot_root "/tmp/" -> "/tmp/", + umount "/", + + network netlink raw, # netlink.c + + network inet stream, # tcp.c + network inet6 stream, + + network inet dgram, # udp.c + network inet6 dgram, + + network unix stream, # tap.c + + network unix dgram, # __openlog(), util.c + + ### Alternatively: include + owner /tmp/** w, # tap_sock_unix_init(), pcap(), + # write_pidfile() + ### + + owner @{HOME}/** w, # pcap(), write_pidfile() + + /usr/bin/passt.avx2 ix, # arch_avx2_exec(), arch.c +} diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta new file mode 100644 index 0000000..844fcf3 --- /dev/null +++ b/contrib/apparmor/usr.bin.pasta @@ -0,0 +1,66 @@ +# SPDX-License-Identifier: AGPL-3.0-or-later +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# contrib/apparmor/usr.bin.pasta - AppArmor profile example/template for pasta +# +# Copyright (c) 2022 Red Hat GmbH +# Author: Stefano Brivio + +abi , + +include + +/usr/bin/pasta flags=(attach_disconnected) { + include # Interactive shell + include + include + include + owner /proc/**/ns/user r, + / r, + capability sys_ptrace, # bash + capability dac_read_search, + capability dac_override, + @{etc_ro}/** r, + /usr/** r, + /lib/** r, + owner @{HOME}/** rw, + owner /tmp/** rw, + + /proc/*/net/tcp r, # procfs_scan_listen(), util.c + /proc/*/net/tcp6 r, + /proc/*/net/udp r, + /proc/*/net/udp6 r, + + /dev/net/tun rw, # tap_ns_tun(), tap.c + + capability net_admin, # for network namespace only + capability setpcap, # drop_caps(), util.c + capability sys_admin, # sandbox(), passt.c + + mount "" -> "/", # sandbox(), passt.c + mount "" -> "/tmp/", + pivot_root "/tmp/" -> "/tmp/", + umount "/", + + network netlink raw, # netlink.c + + network inet stream, # tcp.c + network inet6 stream, + + network inet dgram, # udp.c + network inet6 dgram, + + network unix stream, # tap.c + + network unix dgram, # __openlog(), util.c + + owner /proc/*/gid_map w, # pasta_setup_ns() + owner /proc/*/setgroups w, + owner /proc/*/uid_map w, + owner /proc/sys/net/ipv4/ping_group_range w, + /{usr/,}bin/** mrix, # spawning shell + + /usr/bin/pasta.avx2 ix, # arch_avx2_exec(), arch.c +}