Danish Prakash 88c2f08eba apparmor: Fix access to procfs namespace entries in pasta's abstraction ... From an original patch by Danish Prakash. With commit ff22a78d7b ("pasta: Don't try to watch namespaces in procfs with inotify, use timer instead"), if a filesystem-bound target namespace is passed on the command line, we'll grab a handle on its parent directory. That commit, however, didn't introduce a matching AppArmor rule. Add it here. To access a network namespace procfs entry, we also need a 'ptrace' rule. See commit 594dce66d3 ("isolation: keep CAP_SYS_PTRACE when required") for details as to when we need this -- essentially, it's about operation with Buildah. Reported-by: Jörg Sonnenberger <joerg@bec.de> Link: https://github.com/containers/buildah/issues/5440 Link: https://bugzilla.suse.com/show_bug.cgi?id=1221840 Fixes: ff22a78d7b ("pasta: Don't try to watch namespaces in procfs with inotify, use timer instead") Signed-off-by: Stefano Brivio <sbrivio@redhat.com>		2024-04-05 12:12:26 +02:00
..
abstractions	apparmor: Fix access to procfs namespace entries in pasta's abstraction	2024-04-05 12:12:26 +02:00
usr.bin.passt	apparmor: Add pasta's own profile	2023-09-07 00:31:35 +02:00
usr.bin.pasta	apparmor: Add pasta's own profile	2023-09-07 00:31:35 +02:00