September 2023 - dev

[PATCH] fedora: Replace pasta hard links by copies, mangle Build-IDs
by Stefano Brivio 07 Sep '23

07 Sep '23

The hard link trick didn't actually fix the issue with SELinux file contexts properly: as opposed to symbolic links, SELinux now correctly associates types to the labels that are set -- except that those labels are now shared, so we can end up (depending on how rpm(8) extracts the archives) with /usr/bin/passt having a pasta_exec_t context. This got rather confusing as running restorecon(8) seemed to fix up labels -- but that's simply toggling between passt_exec_t and pasta_exec_t for both links, because each invocation will just "fix" the file with the mismatching context. Replace the hard links with copies. AppArmor's attachment, instead, works with hard links, and if there's no LSM, we can keep symbolic links, so keep symbolic links in the Makefile. With copies, rpmbuild(8) will warn about duplicate Build-IDs in the same package. Mangle them in pasta binaries by summing one to the last byte, modulo one byte, using xxd (provided by vim-common) and disable the automatic rehashing by find-debuginfo(1) -- we already have per-release Build-IDs thanks to $VERSION passed on 'make'. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index d0c6895..51bf5a8 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -9,6 +9,10 @@ %global git_hash {{{ git_head }}} %global selinuxtype targeted +# Different Build-IDs for passt and pasta: don't let find-debuginfo touch them +%undefine _unique_build_ids +%global _no_recompute_build_ids 1 + Name: passt Version: {{{ git_version }}} @@ -19,7 +23,7 @@ Group: System Environment/Daemons URL: https://passt.top/ Source: https://passt.top/passt/snapshot/passt-%{git_hash}.tar.xz -BuildRequires: gcc, make, checkpolicy, selinux-policy-devel +BuildRequires: gcc, make, checkpolicy, selinux-policy-devel, binutils, vim-common Requires: (%{name}-selinux = %{version}-%{release} if selinux-policy-%{selinuxtype}) %description @@ -56,15 +60,28 @@ This package adds SELinux enforcement to passt(1) and pasta(1). %install %make_install DESTDIR=%{buildroot} prefix=%{_prefix} bindir=%{_bindir} mandir=%{_mandir} docdir=%{_docdir}/%{name} -# The Makefile creates symbolic links for pasta, but we need hard links for +# The Makefile creates symbolic links for pasta, but we need actual copies for # SELinux file contexts to work as intended. Same with pasta.avx2 if present. -ln -f %{buildroot}%{_bindir}/passt %{buildroot}%{_bindir}/pasta +# +# To avoid duplicate Build-IDs in the same package, we increase the last byte of +# the value for pasta binaries by one (modulo one byte). Note that we already +# have differentiated Build-IDs per release, courtesy of $VERSION, so we don't +# need find-debuginfo(1) to recalculate them. +rm %{buildroot}%{_bindir}/pasta +objcopy --dump-section .note.gnu.build-id=%{buildroot}/build_id %{buildroot}%{_bindir}/passt +printf '\x'$(printf %02x $(( ( 0x$(xxd -ps -s 35 %{buildroot}/build_id) + 1 ) % 0xff )) ) | dd of=%{buildroot}/build_id seek=35 bs=1 count=1 conv=notrunc +objcopy --update-section .note.gnu.build-id=%{buildroot}/build_id %{buildroot}%{_bindir}/passt %{buildroot}%{_bindir}/pasta +rm %{buildroot}/build_id + %ifarch x86_64 -ln -f %{buildroot}%{_bindir}/passt.avx2 %{buildroot}%{_bindir}/pasta.avx2 +rm %{buildroot}%{_bindir}/pasta.avx2 +objcopy --dump-section .note.gnu.build-id=%{buildroot}/build_id %{buildroot}%{_bindir}/passt.avx2 +printf '\x'$(printf %02x $(( ( 0x$(xxd -ps -s 35 %{buildroot}/build_id) + 1 ) % 0xff )) ) | dd of=%{buildroot}/build_id seek=35 bs=1 count=1 conv=notrunc +objcopy --update-section .note.gnu.build-id=%{buildroot}/build_id %{buildroot}%{_bindir}/passt.avx2 %{buildroot}%{_bindir}/pasta.avx2 +rm %{buildroot}/build_id ln -sr %{buildroot}%{_mandir}/man1/passt.1 %{buildroot}%{_mandir}/man1/passt.avx2.1 ln -sr %{buildroot}%{_mandir}/man1/pasta.1 %{buildroot}%{_mandir}/man1/pasta.avx2.1 -install -p -m 755 %{buildroot}%{_bindir}/passt.avx2 %{buildroot}%{_bindir}/pasta.avx2 %endif pushd contrib/selinux -- 2.39.2

2 4

[PATCH] fedora: Replace pasta hard links by separate builds
by Stefano Brivio 07 Sep '23

07 Sep '23

The hard link trick didn't actually fix the issue with SELinux file contexts properly: as opposed to symbolic links, SELinux now correctly associates types to the labels that are set -- except that those labels are now shared, so we can end up (depending on how rpm(8) extracts the archives) with /usr/bin/passt having a pasta_exec_t context. This got rather confusing as running restorecon(8) seemed to fix up labels -- but that's simply toggling between passt_exec_t and pasta_exec_t for both links, because each invocation will just "fix" the file with the mismatching context. Replace the hard links with two separate builds of the binary, as suggested by David. The build is reproducible, so we pass "-pasta" in the VERSION for pasta's build. This is wasteful but better than the alternative. Just copying the binary over would otherwise cause issues with debuginfo packages due to duplicate Build-IDs -- and rpmbuild(8) also warns about them. Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/fedora/passt.spec | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec index d0c6895..825cd76 100644 --- a/contrib/fedora/passt.spec +++ b/contrib/fedora/passt.spec @@ -51,17 +51,27 @@ This package adds SELinux enforcement to passt(1) and pasta(1). %build %set_build_flags -%make_build VERSION="%{version}-%{release}.%{_arch}" +# The Makefile creates symbolic links for pasta, but we need actual copies for +# SELinux file contexts to work as intended. Same with pasta.avx2 if present. +# Build twice, changing the version string, to avoid duplicate Build-IDs. +%make_build VERSION="%{version}-%{release}.%{_arch}-pasta" +mv -f passt pasta +%ifarch x86_64 +mv -f passt.avx2 pasta.avx2 +%make_build passt passt.avx2 VERSION="%{version}-%{release}.%{_arch}" +%else +%make_build passt VERSION="%{version}-%{release}.%{_arch}" +%endif %install +# Already built (not as symbolic links), see above +touch pasta +%ifarch x86_64 +touch pasta.avx2 +%endif %make_install DESTDIR=%{buildroot} prefix=%{_prefix} bindir=%{_bindir} mandir=%{_mandir} docdir=%{_docdir}/%{name} -# The Makefile creates symbolic links for pasta, but we need hard links for -# SELinux file contexts to work as intended. Same with pasta.avx2 if present. -ln -f %{buildroot}%{_bindir}/passt %{buildroot}%{_bindir}/pasta %ifarch x86_64 -ln -f %{buildroot}%{_bindir}/passt.avx2 %{buildroot}%{_bindir}/pasta.avx2 - ln -sr %{buildroot}%{_mandir}/man1/passt.1 %{buildroot}%{_mandir}/man1/passt.avx2.1 ln -sr %{buildroot}%{_mandir}/man1/pasta.1 %{buildroot}%{_mandir}/man1/pasta.avx2.1 install -p -m 755 %{buildroot}%{_bindir}/passt.avx2 %{buildroot}%{_bindir}/pasta.avx2 -- 2.39.2

1 0

[PATCH 0/5] Fixes to AppArmor policy, passt/pasta profile split
by Stefano Brivio 07 Sep '23

07 Sep '23

These assume that distributions with AppArmor support will install pasta and pasta.avx2 as hard links, and I prepared matching changes for the Debian package. This particular aspect is distribution-specific, so I'm not changing the symlink install from the Makefile anyway. Stefano Brivio (5): apparmor: Use abstractions/nameservice to deal with symlinked resolv.conf apparmor: Explicitly pass options we use while remounting root filesystem apparmor: Allow read-only access to uid_map apparmor: Allow pasta to remount /proc, access entries under its own copy apparmor: Add pasta's own profile contrib/apparmor/abstractions/passt | 7 ++++--- contrib/apparmor/abstractions/pasta | 9 +++++++++ contrib/apparmor/usr.bin.passt | 12 ++---------- contrib/apparmor/usr.bin.pasta | 27 +++++++++++++++++++++++++++ 4 files changed, 42 insertions(+), 13 deletions(-) create mode 100644 contrib/apparmor/usr.bin.pasta -- 2.39.2

1 5

[RFC v2] tcp: add support for read with offset when using MSG_PEEK
by Jon Maloy 05 Sep '23

05 Sep '23

When reading received messages with MSG_PEEK, we sometines have to read the leading bytes of the stream several times, only to reach the bytes we really want. This is clearly non-optimal. What we would want is something similar to pread/preadv(), but working even for tcp sockets. At the same time, we obviously don't want to add any new arguments to the recv/recvmsg() calls. In this commit, we allow the user to set iovec.iov_base in the first vector entry to NULL. This tells the socket to skip the first entry, hence making the iov_len field of that entry indicate the offset value. This way, there is no need to add any new arguments. This change is simple and non-intrusive, and should be safe addition to the socket API. We have measured it to give a throughput improvement of 8-10 % for the protocol splicer 'passst', which is used in KubeVirt containers. Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> works with original msghdr Signed-off-by: Jon Maloy <jmaloy(a)redhat.com> --- net/ipv4/tcp.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 33f559f491c8..1d89337e89b6 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -2428,6 +2428,7 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, struct tcp_sock *tp = tcp_sk(sk); int copied = 0; u32 peek_seq; + u32 peek_offset; u32 *seq; unsigned long used; int err; @@ -2435,7 +2436,6 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, long timeo; struct sk_buff *skb, *last; u32 urg_hole = 0; - err = -ENOTCONN; if (sk->sk_state == TCP_LISTEN) goto out; @@ -2469,6 +2469,14 @@ static int tcp_recvmsg_locked(struct sock *sk, struct msghdr *msg, size_t len, if (flags & MSG_PEEK) { peek_seq = tp->copied_seq; seq = &peek_seq; + if (msg->msg_iter.iov[0].iov_base == NULL) { + peek_offset = msg->msg_iter.iov[0].iov_len; + msg->msg_iter.iov = &msg->msg_iter.iov[1]; + msg->msg_iter.nr_segs -= 1; + msg->msg_iter.count -= peek_offset; + len -= peek_offset; + *seq += peek_offset; + } } target = sock_rcvlowat(sk, flags & MSG_WAITALL, len); -- 2.39.0

3 5