1
0
mirror of https://passt.top/passt synced 2024-12-22 21:55:22 +00:00
passt/contrib
Danish Prakash 88c2f08eba apparmor: Fix access to procfs namespace entries in pasta's abstraction
From an original patch by Danish Prakash.

With commit ff22a78d7b ("pasta: Don't try to watch namespaces in
procfs with inotify, use timer instead"), if a filesystem-bound
target namespace is passed on the command line, we'll grab a handle
on its parent directory. That commit, however, didn't introduce a
matching AppArmor rule. Add it here.

To access a network namespace procfs entry, we also need a 'ptrace'
rule. See commit 594dce66d3 ("isolation: keep CAP_SYS_PTRACE when
required") for details as to when we need this -- essentially, it's
about operation with Buildah.

Reported-by: Jörg Sonnenberger <joerg@bec.de>
Link: https://github.com/containers/buildah/issues/5440
Link: https://bugzilla.suse.com/show_bug.cgi?id=1221840
Fixes: ff22a78d7b ("pasta: Don't try to watch namespaces in procfs with inotify, use timer instead")
Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
2024-04-05 12:12:26 +02:00
..
apparmor apparmor: Fix access to procfs namespace entries in pasta's abstraction 2024-04-05 12:12:26 +02:00
fedora fedora: Switch license identifier to SPDX 2024-03-18 08:57:47 +01:00
kata-containers Don't abbreviate ip(8) arguments in examples and tests 2022-06-15 09:38:10 +02:00
selinux selinux: Allow pasta to remount procfs 2024-02-16 09:43:12 +01:00