September 2025 - dev

[PATCH v8 0/8] Use true MAC address of LAN local remote hosts
by Jon Maloy 22 Sep '25

22 Sep '25

Bug #120 asks us to use the true MAC addresses of LAN local remote hosts, since some programs need this information. These commits introduces this for ARP, NDP, UDP, TCP and ICMP. --- v3: Updated according to feedback from Stefano and David: - Made the ARP/NDP lookup call filter out the requested address by itself, qualified by the index if the template interface - Moved the flow specific MAC address from struct flowside to struct flow_common. v4: - Updated according to feedback from David and Stefan - Added a cache table for ARP/NDP table contents v5: - Updated according to feedback from David and Stefan - Added cache table entries to FIFO/LRU queue - New criteria for when to consult ARP/NDP v6: - Simplified and merged mac cache table commits - Other changes after feedback from David. v7: - Fixes in patch #2 based on feedback from David and Stefano. v8: - Redesigned netlink and cache table part to be based on a subscription model. Jon Maloy (8): netlink: add subsciption on changes in NDP/ARP table fwd: Add cache table for ARP/NDP contents arp/ndp: respond with true MAC address of LAN local remote hosts flow: add MAC address of LAN local remote hosts to flow udp: forward external source MAC address through tap interface tcp: forward external source MAC address through tap interface tap: change signature of function tap_push_l2h() icmp: let icmp use mac address from flowside structure arp.c | 9 ++- conf.c | 1 + epoll_type.h | 2 + flow.c | 2 + flow.h | 2 + fwd.c | 167 +++++++++++++++++++++++++++++++++++++++++++++++-- fwd.h | 9 +++ icmp.c | 8 ++- inany.c | 1 + ndp.c | 10 ++- netlink.c | 119 +++++++++++++++++++++++++++++++++++ netlink.h | 4 ++ passt.c | 17 +++-- passt.h | 3 +- pasta.c | 2 +- tap.c | 24 ++++--- tap.h | 7 ++- tcp.c | 18 ++++-- tcp.h | 2 +- tcp_buf.c | 37 +++++------ tcp_internal.h | 4 +- tcp_vu.c | 5 +- udp.c | 57 ++++++++++------- udp.h | 2 +- 24 files changed, 429 insertions(+), 83 deletions(-) -- 2.50.1

1 8

Re: [PATCH 1/2] selinux: add container_var_run_t type transition
by Stefano Brivio 20 Sep '25

20 Sep '25

On Fri, 19 Sep 2025 11:22:20 -0400 Lokesh Mandvekar <lmandvek(a)redhat.com> wrote: > We now have pasta tests in place for container-selinux upstream > https://github.com/containers/container-selinux/pull/409 . > So, any future potential conflicts should be caught pre-merge. Thanks, that was quick! I'll keep you all posted once we have a release with the updated policy including container_var_run_t. -- Stefano

1 1

[PATCH v2] Add --stats option to display event statistics
by Laurent Vivier 20 Sep '25

20 Sep '25

Introduce a new --stats DELAY option that displays event statistics tables showing counts by epoll event type. Statistics are printed to stderr with a minimum delay between updates, and only when events occur. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- conf.c | 8 ++++++++ passt.1 | 5 +++++ passt.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ passt.h | 2 ++ 4 files changed, 73 insertions(+) diff --git a/conf.c b/conf.c index 02e903b5cf70..66b9e63400ec 100644 --- a/conf.c +++ b/conf.c @@ -835,6 +835,8 @@ static void usage(const char *name, FILE *f, int status) "\n" " -d, --debug Be verbose\n" " --trace Be extra verbose, implies --debug\n" + " --stats DELAY Display events statistics\n" + " minimum DELAY seconds between updates\n" " -q, --quiet Don't print informational messages\n" " -f, --foreground Don't run in background\n" " default: run in background\n" @@ -1480,6 +1482,7 @@ void conf(struct ctx *c, int argc, char **argv) {"repair-path", required_argument, NULL, 28 }, {"migrate-exit", no_argument, NULL, 29 }, {"migrate-no-linger", no_argument, NULL, 30 }, + {"stats", required_argument, NULL, 31 }, { 0 }, }; const char *optstring = "+dqfel:hs:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1708,6 +1711,11 @@ void conf(struct ctx *c, int argc, char **argv) die("--migrate-no-linger is for vhost-user mode only"); c->migrate_no_linger = true; + break; + case 31: + if (!c->foreground) + die("Can't display statistics if not running in foreground"); + c->stats = strtol(optarg, NULL, 0); break; case 'd': c->debug = 1; diff --git a/passt.1 b/passt.1 index af5726a7f1c5..0c17454c3e43 100644 --- a/passt.1 +++ b/passt.1 @@ -84,6 +84,11 @@ Be verbose, don't log to the system logger. .BR \-\-trace Be extra verbose, show single packets. Implies \fB--debug\fR. +.TP +.BR \-\-stats " " \fIDELAY\fR +Display events statistics with a minimum \fIDELAY\fR seconds between updates. +If there is no event, statistics are not displayed. + .TP .BR \-q ", " \-\-quiet Don't print informational messages. diff --git a/passt.c b/passt.c index a4ec115d1784..31fbb75b1b12 100644 --- a/passt.c +++ b/passt.c @@ -83,6 +83,14 @@ char *epoll_type_str[] = { static_assert(ARRAY_SIZE(epoll_type_str) == EPOLL_NUM_TYPES, "epoll_type_str[] doesn't match enum epoll_type"); +/** + * struct passt_stats - Statistics + * @events: Event counters for epoll type events + */ +struct passt_stats { + unsigned long events[EPOLL_NUM_TYPES]; +}; + /** * post_handler() - Run periodic and deferred tasks for L4 protocol handlers * @c: Execution context @@ -174,6 +182,53 @@ static void exit_handler(int signal) _exit(EXIT_SUCCESS); } +/** + * print_stats() - Print event statistics table to stderr + * @c: Execution context + * @stats: Event counters + * @now: Current timestamp + */ +static void print_stats(const struct ctx *c, const struct passt_stats *stats, + const struct timespec *now) +{ + static struct timespec before; + static int lines_printed; + long long elapsed_ns; + int i; + + if (!c->stats) + return; + + elapsed_ns = (now->tv_sec - before.tv_sec) * 1000000000LL + + (now->tv_nsec - before.tv_nsec); + + if (elapsed_ns < c->stats * 1000000000LL) + return; + + before = *now; + + if (!(lines_printed % 20)) { + /* Table header */ + for (i = 1; i < EPOLL_NUM_TYPES; i++) { + int j; + + for (j = 0; j < i * (6 + 1); j++) { + if (j && !(j % (6 + 1))) + FPRINTF(stderr, "|"); + else + FPRINTF(stderr, " "); + } + FPRINTF(stderr, "%s\n", epoll_type_str[i]); + } + } + + FPRINTF(stderr, " "); + for (i = 1; i < EPOLL_NUM_TYPES; i++) + FPRINTF(stderr, " %6lu", stats->events[i]); + FPRINTF(stderr, "\n"); + lines_printed++; +} + /** * main() - Entry point and main loop * @argc: Argument count @@ -191,6 +246,7 @@ static void exit_handler(int signal) int main(int argc, char **argv) { struct epoll_event events[EPOLL_EVENTS]; + struct passt_stats stats = { 0 }; int nfds, i, devnull_fd = -1; struct ctx c = { 0 }; struct rlimit limit; @@ -362,6 +418,8 @@ loop: /* Can't happen */ ASSERT(0); } + stats.events[ref.type]++; + print_stats(&c, &stats, &now); } post_handler(&c, &now); diff --git a/passt.h b/passt.h index 3ffc19fdae05..0075eb4b3b16 100644 --- a/passt.h +++ b/passt.h @@ -187,6 +187,7 @@ struct ip6_ctx { * @mode: Operation mode, qemu/UNIX domain socket or namespace/tap * @debug: Enable debug mode * @trace: Enable tracing (extra debug) mode + * @stats: Events statistics delay (0 means disabled) * @quiet: Don't print informational messages * @foreground: Run in foreground, don't log to stderr by default * @nofile: Maximum number of open files (ulimit -n) @@ -248,6 +249,7 @@ struct ctx { enum passt_modes mode; int debug; int trace; + int stats; int quiet; int foreground; int nofile; -- 2.50.1

2 1

passt: new version 2025_09_19.623dbf6 available
by Stefano Brivio 20 Sep '25

20 Sep '25

The new version with tag 2025_09_19.623dbf6 includes the following changes: 623dbf6 Add --stats option to display event statistics ad4aae7 netlink: Drop nexthop state flags from routes we duplicate 080f176 Add CONTRIBUTING.md c66be2c selinux: add missing file contexts for Podman fd1bcc3 selinux: add container_var_run_t type transition 6f23cb9 dhcp: Fix coding style violations in dhcp() function 1f22fde Improve clarity of comment e2920e3 Send an initial ARP and NDP request to resolve the guest IP address 142b3d8 Fix --no-icmp description and make it imply --no-ndp 07cb07d Introduce constant MAC_BROADCAST fc0affc Show debug message whenever we observe a new guest MAC address https://passt.top/passt/log/?qt=range&q=2025_09_11.6cbcccc..2025_09_19.623d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9584424/ permanent mirror: https://passt.top/builds/copr/0^20250919.g623dbf6/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g623dbf6-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_623dbf6-1_all.deb -- Stefano

1 0

passt: new version 2025_09_19.623dbf6 available
by Stefano Brivio 20 Sep '25

20 Sep '25

The new version with tag 2025_09_19.623dbf6 includes the following changes: 623dbf6 Add --stats option to display event statistics ad4aae7 netlink: Drop nexthop state flags from routes we duplicate 080f176 Add CONTRIBUTING.md c66be2c selinux: add missing file contexts for Podman fd1bcc3 selinux: add container_var_run_t type transition 6f23cb9 dhcp: Fix coding style violations in dhcp() function 1f22fde Improve clarity of comment e2920e3 Send an initial ARP and NDP request to resolve the guest IP address 142b3d8 Fix --no-icmp description and make it imply --no-ndp 07cb07d Introduce constant MAC_BROADCAST fc0affc Show debug message whenever we observe a new guest MAC address https://passt.top/passt/log/?qt=range&q=2025_09_11.6cbcccc..2025_09_19.623d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9584424/ permanent mirror: https://passt.top/builds/copr/0^20250919.g623dbf6/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g623dbf6-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_623dbf6-1_all.deb -- Stefano

1 0

passt: new version 2025_09_19.623dbf6 available
by Stefano Brivio 20 Sep '25

20 Sep '25

The new version with tag 2025_09_19.623dbf6 includes the following changes: 623dbf6 Add --stats option to display event statistics ad4aae7 netlink: Drop nexthop state flags from routes we duplicate 080f176 Add CONTRIBUTING.md c66be2c selinux: add missing file contexts for Podman fd1bcc3 selinux: add container_var_run_t type transition 6f23cb9 dhcp: Fix coding style violations in dhcp() function 1f22fde Improve clarity of comment e2920e3 Send an initial ARP and NDP request to resolve the guest IP address 142b3d8 Fix --no-icmp description and make it imply --no-ndp 07cb07d Introduce constant MAC_BROADCAST fc0affc Show debug message whenever we observe a new guest MAC address https://passt.top/passt/log/?qt=range&q=2025_09_11.6cbcccc..2025_09_19.623d… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/9584424/ permanent mirror: https://passt.top/builds/copr/0^20250919.g623dbf6/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g623dbf6-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_623dbf6-1_all.deb -- Stefano

1 0

[PATCH] Add --stats option to display event statistics
by Laurent Vivier 19 Sep '25

19 Sep '25

Introduce a new --stats DELAY option that displays event statistics tables showing counts by epoll event type. Statistics are printed to stderr with a minimum delay between updates, and only when events occur. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- conf.c | 6 ++++++ passt.1 | 6 ++++++ passt.c | 64 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ passt.h | 1 + 4 files changed, 77 insertions(+) diff --git a/conf.c b/conf.c index 02e903b5cf70..9aba27cef806 100644 --- a/conf.c +++ b/conf.c @@ -835,6 +835,8 @@ static void usage(const char *name, FILE *f, int status) "\n" " -d, --debug Be verbose\n" " --trace Be extra verbose, implies --debug\n" + " --stats DELAY Display events statistics\n" + " minimum DELAY seconds between updates\n" " -q, --quiet Don't print informational messages\n" " -f, --foreground Don't run in background\n" " default: run in background\n" @@ -1480,6 +1482,7 @@ void conf(struct ctx *c, int argc, char **argv) {"repair-path", required_argument, NULL, 28 }, {"migrate-exit", no_argument, NULL, 29 }, {"migrate-no-linger", no_argument, NULL, 30 }, + {"stats", required_argument, NULL, 31 }, { 0 }, }; const char *optstring = "+dqfel:hs:F:I:p:P:m:a:n:M:g:i:o:D:S:H:461t:u:T:U:"; @@ -1708,6 +1711,9 @@ void conf(struct ctx *c, int argc, char **argv) die("--migrate-no-linger is for vhost-user mode only"); c->migrate_no_linger = true; + break; + case 31: + c->stats = strtol(optarg, NULL, 0); break; case 'd': c->debug = 1; diff --git a/passt.1 b/passt.1 index af5726a7f1c5..d5cde2c424d0 100644 --- a/passt.1 +++ b/passt.1 @@ -84,6 +84,12 @@ Be verbose, don't log to the system logger. .BR \-\-trace Be extra verbose, show single packets. Implies \fB--debug\fR. +.TP +.BR \-\-stats " " \fIDELAY\fR +Display events statistics with a +minimum \fIDELAY\fR seconds between updates. If there is no event, +statistics are not displayed. + .TP .BR \-q ", " \-\-quiet Don't print informational messages. diff --git a/passt.c b/passt.c index a4ec115d1784..afd7f709e58a 100644 --- a/passt.c +++ b/passt.c @@ -83,6 +83,31 @@ char *epoll_type_str[] = { static_assert(ARRAY_SIZE(epoll_type_str) == EPOLL_NUM_TYPES, "epoll_type_str[] doesn't match enum epoll_type"); +char *epoll_type_tag[] = { + [EPOLL_TYPE_TCP] = "TCP", + [EPOLL_TYPE_TCP_SPLICE] = "TCPSPL", + [EPOLL_TYPE_TCP_LISTEN] = "TCPLSN", + [EPOLL_TYPE_TCP_TIMER] = "TCPTMR", + [EPOLL_TYPE_UDP_LISTEN] = "UDPLSN", + [EPOLL_TYPE_UDP] = "UDP", + [EPOLL_TYPE_PING] = "PING", + [EPOLL_TYPE_NSQUIT_INOTIFY] = "INOTF", + [EPOLL_TYPE_NSQUIT_TIMER] = "TIMER", + [EPOLL_TYPE_TAP_PASTA] = "PASTA", + [EPOLL_TYPE_TAP_PASST] = "PASST", + [EPOLL_TYPE_TAP_LISTEN] = "TAPLSN", + [EPOLL_TYPE_VHOST_CMD] = "VUCMD", + [EPOLL_TYPE_VHOST_KICK] = "VUKICK", + [EPOLL_TYPE_REPAIR_LISTEN] = "REPLSN", + [EPOLL_TYPE_REPAIR] = "REPAIR", +}; +static_assert(ARRAY_SIZE(epoll_type_tag) == EPOLL_NUM_TYPES, + "epoll_type_tag[] doesn't match enum epoll_type"); + +struct passt_stats { + unsigned long events[EPOLL_NUM_TYPES]; +}; + /** * post_handler() - Run periodic and deferred tasks for L4 protocol handlers * @c: Execution context @@ -174,6 +199,42 @@ static void exit_handler(int signal) _exit(EXIT_SUCCESS); } +/** + * print_stats() - Print event statistics table to stderr + * @c: Execution context + * @stats: Event counters + * @now: Current timestamp + */ +static void print_stats(const struct ctx *c, const struct passt_stats *stats, + const struct timespec *now) +{ + int i; + static struct timespec before; + long long elapsed_ns; + + if (!c->stats) + return; + + elapsed_ns = (now->tv_sec - before.tv_sec) * 1000000000LL + + (now->tv_nsec - before.tv_nsec); + + if (elapsed_ns < c->stats * 1000000000LL) + return; + + before = *now; + + /* table header */ + FPRINTF(stderr, "\t"); + for (i = 1; i < EPOLL_NUM_TYPES; i++) + FPRINTF(stderr, "%6s\t", epoll_type_tag[i]); + FPRINTF(stderr, "\n"); + /* main loop */ + FPRINTF(stderr, "MAIN\t"); + for (i = 1; i < EPOLL_NUM_TYPES; i++) + FPRINTF(stderr, "%6lu\t", stats->events[i]); + FPRINTF(stderr, "\n"); +} + /** * main() - Entry point and main loop * @argc: Argument count @@ -196,6 +257,7 @@ int main(int argc, char **argv) struct rlimit limit; struct timespec now; struct sigaction sa; + struct passt_stats stats = { 0 }; if (clock_gettime(CLOCK_MONOTONIC, &log_start)) die_perror("Failed to get CLOCK_MONOTONIC time"); @@ -362,6 +424,8 @@ loop: /* Can't happen */ ASSERT(0); } + stats.events[ref.type]++; + print_stats(&c, &stats, &now); } post_handler(&c, &now); diff --git a/passt.h b/passt.h index 3ffc19fdae05..283e7c8a832c 100644 --- a/passt.h +++ b/passt.h @@ -248,6 +248,7 @@ struct ctx { enum passt_modes mode; int debug; int trace; + int stats; int quiet; int foreground; int nofile; -- 2.50.1

2 1

[PATCH] netlink: Drop nexthop state flags from routes we duplicate
by Stefano Brivio 19 Sep '25

19 Sep '25

The kernel doesn't like those (EINVAL) on RTM_NEWROUTE, as they are flags representing states, not configuration. Link: https://github.com/containers/podman/discussions/27104 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- netlink.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/netlink.c b/netlink.c index 8f82e73..c436780 100644 --- a/netlink.c +++ b/netlink.c @@ -565,6 +565,11 @@ int nl_route_dup(int s_src, unsigned int ifi_src, if (nh->nlmsg_type != RTM_NEWROUTE) continue; + /* nexthop state flags don't apply to freshly created routes, + * and the kernel will refuse our route if they are set. + */ + rtm->rtm_flags &= ~RTNH_COMPARE_MASK; + for (rta = RTM_RTA(rtm), na = RTM_PAYLOAD(nh); RTA_OK(rta, na); rta = RTA_NEXT(rta, na)) { /* RTA_OIF and RTA_MULTIPATH attributes carry the -- 2.43.0

3 2

[PATCH v6 1/5]
by Volker Diels-Grabsch 19 Sep '25

19 Sep '25

This incorporates all feedback of v5, and the commits are slightly reordered so the comment of the last commit makes more sense.

3 13

[PATCH 1/2] selinux: add container_var_run_t type transition
by Paul Holzinger 18 Sep '25

18 Sep '25

In some cases the podman runroot directory used to be labelled container_var_run_t instead of user_tmp_t which was expected here. Starting with a recent container-selinux change the runroot is now always container_var_run_t so make the policy handle both types to allow for a better upgrade path where passt-selinux and container-selinux are not updated at the same time. Link: https://github.com/containers/container-selinux/pull/405 Link: https://github.com/containers/podman/issues/26473 Signed-off-by: Paul Holzinger <pholzing(a)redhat.com> --- contrib/selinux/pasta.te | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index c0a1e9b..24e58c8 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -96,6 +96,7 @@ require { role staff_r; role user_r; type container_runtime_t; + type container_var_run_t; type container_t; type systemd_user_runtimedir_t; } @@ -242,8 +243,12 @@ type_transition container_runtime_t pasta_exec_t : process pasta_t; allow container_runtime_t pasta_t:process transition; # Label the user network namespace files +# Note podman files used to be user_tmp_t but now are container_var_run_t since +# https://github.com/containers/container-selinux/issues/404. type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "netns"; +type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "netns"; type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootless-netns"; +type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns"; allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; allow pasta_t ifconfig_var_run_t:file { create open write }; allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; -- 2.51.0

2 5