January 2026 - dev

passt: new version 2026_01_20.386b5f5 available
by Stefano Brivio 21 Jan '26

21 Jan '26

The new version with tag 2026_01_20.386b5f5 includes the following changes: 386b5f5 flow: Remove EPOLLFD_ID_INVALID 90287c2 tcp: Register fds with epoll at flow creation 0fbd7af tcp_splice: Register fds with epoll at flow creation cee7eb0 conf, pasta: Add --splice-only option 4a0d507 flow, fwd: Optimise forwarding rule lookup using epoll ref when possible fe37028 fwd, tcp, udp: Add forwarding rule to listening socket epoll references 01bcdb9 fwd: Remap ports based directly on forwarding rule f56a822 flow, fwd: Consult rules table when forwarding a new flow from socket a0af19f fwd: Generate auto-forward exclusions from socket fd tables 03a9c4b conf, fwd: Check forwarding table for conflicting rules acb7a30 tcp, udp: Remove old auto-forwarding socket arrays b223bec fwd, tcp, udp: Set up listening sockets based on forward table 0c611bc ip: Add ipproto_name() function da49557 fwd: Make space to store listening sockets in forward table e2633b9 conf, fwd: Record "auto" port forwards in forwarding table 9323ab9 conf: Accurately record ifname and address for outbound forwards bd52f61 conf, fwd: Keep a table of our port forwarding configuration 016e3d7 inany: Extend inany_ntop() to treat NULL as a fully unspecified address https://passt.top/passt/log/?qt=range&q=2026_01_17.81c97f6..2026_01_20.386b… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10039669/ permanent mirror: https://passt.top/builds/copr/0^20260120.g386b5f5/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g386b5f5-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_386b5f5-1_all.deb -- Stefano

1 0

[PATCH v2 0/3] Register TCP flows with epoll at creation time
by Laurent Vivier 20 Jan '26

20 Jan '26

This series simplifies epoll registration by moving it to flow creation time rather than deferring it to the first event update. By registering sockets with epoll immediately (using events=0), the epoll control functions can always use EPOLL_CTL_MOD, eliminating the need to track whether a flow is already registered. Patch 1 registers both splice sockets with epoll in tcp_splice_connect() before initiating the connection, allowing tcp_splice_epoll_ctl() to always use EPOLL_CTL_MOD. Patch 2 does the same for regular TCP connections in tcp_conn_from_tap(), tcp_tap_conn_from_sock(), and tcp_flow_migrate_target(), simplifying tcp_epoll_ctl() by removing the ADD/MOD conditional logic. Patch 3 removes EPOLLFD_ID_INVALID and related infrastructure now that all flows are registered at creation: flow_in_epoll(), flow_epollid_clear(), and the defensive checks in flow_epollfd(). Thanks, Laurent Changes in v2: - Explained error handling and rollback behavior in commit message (patch 1) - Added error handling for flow_epoll_set() in tcp_conn_from_tap() and tcp_tap_conn_from_sock() (patch 2) - Added ASSERT for epollid bounds check in flow_epollid_register() (patch 3) Laurent Vivier (3): tcp_splice: Register fds with epoll at flow creation tcp: Register fds with epoll at flow creation flow: Remove EPOLLFD_ID_INVALID flow.c | 34 +++------------------------------- flow.h | 6 +----- icmp.c | 1 - tcp.c | 47 ++++++++++++++++++++++++----------------------- tcp_splice.c | 20 ++++++++++---------- udp_flow.c | 1 - 6 files changed, 38 insertions(+), 71 deletions(-) -- 2.52.0

3 7

[PATCH] tcp: Close timer fd when removing it from epoll
by Laurent Vivier 20 Jan '26

20 Jan '26

When tcp_epoll_ctl() handles a CLOSED connection, it removes the timer from epoll but leaves the fd open until tcp_flow_defer() eventually closes it. Close the timer fd immediately when removing it from epoll, since there's no reason to keep an fd around that's no longer monitored. Set conn->timer to -1 to prevent a double-close in tcp_flow_defer(). Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- tcp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tcp.c b/tcp.c index 1db861705ddb..62064efcc1ef 100644 --- a/tcp.c +++ b/tcp.c @@ -535,8 +535,11 @@ static int tcp_epoll_ctl(struct tcp_tap_conn *conn) int epollfd = flow_epollfd(&conn->f); epoll_del(epollfd, conn->sock); - if (conn->timer != -1) + if (conn->timer != -1) { epoll_del(epollfd, conn->timer); + close(conn->timer); + conn->timer = -1; + } } return 0; -- 2.52.0

2 2

[PATCH v2] conf, pasta: Add --splice-only option
by Yumei Huang 19 Jan '26

19 Jan '26

This patch introduces a mode where we only forward loopback connections and traffic between two namespaces (via the loopback interface, 'lo'), without a tap device. It might be used to fix up podman IPv4 / IPv6 loopback mapping when using rootlesskit for forwarding ports, or a way to implement isolated containers. In this mode, --host-lo-to-ns-lo and --no-icmp are automatically enabled. Option --no-splice is rejected. Link: https://bugs.passt.top/show_bug.cgi?id=149 Signed-off-by: Yumei Huang <yuhuang(a)redhat.com> --- conf.c | 39 ++++++++++++++++++++++++++++----------- fwd.c | 3 +++ passt.1 | 5 +++++ passt.h | 2 ++ pasta.c | 3 +++ tap.c | 11 +++++++---- 6 files changed, 48 insertions(+), 15 deletions(-) diff --git a/conf.c b/conf.c index dbff87c..9d88ad7 100644 --- a/conf.c +++ b/conf.c @@ -1059,7 +1059,8 @@ pasta_opts: " --no-copy-addrs DEPRECATED:\n" " Don't copy all addresses to namespace\n" " --ns-mac-addr ADDR Set MAC address on tap interface\n" - " --no-splice Disable inbound socket splicing\n"); + " --no-splice Disable inbound socket splicing\n" + " --splice-only Only enable loopback forwarding\n"); passt_exit(status); } @@ -1142,7 +1143,7 @@ static void conf_print(const struct ctx *c) inet_ntop(AF_INET6, &c->ip6.addr_out, buf6, sizeof(buf6))); } - if (c->mode == MODE_PASTA) + if (c->mode == MODE_PASTA && !c->splice_only) info("Namespace interface: %s", c->pasta_ifn); info("MAC:"); @@ -1465,6 +1466,7 @@ void conf(struct ctx *c, int argc, char **argv) {"no-ndp", no_argument, &c->no_ndp, 1 }, {"no-ra", no_argument, &c->no_ra, 1 }, {"no-splice", no_argument, &c->no_splice, 1 }, + {"splice-only", no_argument, &c->splice_only, 1 }, {"freebind", no_argument, &c->freebind, 1 }, {"no-map-gw", no_argument, &no_map_gw, 1 }, {"ipv4-only", no_argument, NULL, '4' }, @@ -1961,8 +1963,11 @@ void conf(struct ctx *c, int argc, char **argv) } } while (name != -1); - if (c->mode != MODE_PASTA) + if (c->mode != MODE_PASTA) { c->no_splice = 1; + if (c->splice_only) + die("--splice-only is for pasta mode only"); + } if (c->mode == MODE_PASTA && !c->pasta_conf_ns) { if (copy_routes_opt) @@ -1971,6 +1976,16 @@ void conf(struct ctx *c, int argc, char **argv) die("--no-copy-addrs needs --config-net"); } + if (c->mode == MODE_PASTA && c->splice_only) { + if (c->no_splice) + die("--splice-only is incompatible with --no-splice"); + + c->host_lo_to_ns_lo = 1; + c->no_icmp = 1; + c->no_dns = 1; + c->no_dns_search = 1; + } + if (!ifi4 && *c->ip4.ifname_out) ifi4 = if_nametoindex(c->ip4.ifname_out); @@ -1994,9 +2009,9 @@ void conf(struct ctx *c, int argc, char **argv) log_conf_parsed = true; /* Stop printing everything */ nl_sock_init(c, false); - if (!v6_only) + if (!v6_only && !c->splice_only) c->ifi4 = conf_ip4(ifi4, &c->ip4); - if (!v4_only) + if (!v4_only && !c->splice_only) c->ifi6 = conf_ip6(ifi6, &c->ip6); if (c->ifi4 && c->mtu < IPV4_MIN_MTU) { @@ -2018,16 +2033,18 @@ void conf(struct ctx *c, int argc, char **argv) } if (!c->ifi4 && !v6_only) { - info("IPv4: no external interface as template, use local mode"); - - conf_ip4_local(&c->ip4); + if (!c->splice_only) { + info("IPv4: no external interface as template, use local mode"); + conf_ip4_local(&c->ip4); + } c->ifi4 = -1; } if (!c->ifi6 && !v4_only) { - info("IPv6: no external interface as template, use local mode"); - - conf_ip6_local(&c->ip6); + if (!c->splice_only) { + info("IPv6: no external interface as template, use local mode"); + conf_ip6_local(&c->ip6); + } c->ifi6 = -1; } diff --git a/fwd.c b/fwd.c index 961c533..6cdb197 100644 --- a/fwd.c +++ b/fwd.c @@ -771,6 +771,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, uint8_t proto, return PIF_SPLICE; } + if (c->splice_only) + return PIF_NONE; + if (!nat_inbound(c, &ini->eaddr, &tgt->oaddr)) { if (inany_v4(&ini->eaddr)) { if (IN4_IS_ADDR_UNSPECIFIED(&c->ip4.our_tap_addr)) diff --git a/passt.1 b/passt.1 index db0d662..8e8e179 100644 --- a/passt.1 +++ b/passt.1 @@ -755,6 +755,11 @@ Default is to let the tap driver build a pseudorandom hardware address. Disable the bypass path for inbound, local traffic. See the section \fBHandling of local traffic in pasta\fR in the \fBNOTES\fR for more details. +.TP +.BR \-\-splice-only +Do not create a tap device in the namespace. In this mode, \fIpasta\fR only +forwards loopback traffic between namespaces. + .SH EXAMPLES .SS \fBpasta diff --git a/passt.h b/passt.h index f3664ce..299185b 100644 --- a/passt.h +++ b/passt.h @@ -200,6 +200,7 @@ struct ip6_ctx { * @no_ndp: Disable NDP handler altogether * @no_ra: Disable router advertisements * @no_splice: Disable socket splicing for inbound traffic + * @splice_only: Only enable loopback forwarding * @host_lo_to_ns_lo: Map host loopback addresses to ns loopback addresses * @freebind: Allow binding of non-local addresses for forwarding * @low_wmem: Low probed net.core.wmem_max @@ -277,6 +278,7 @@ struct ctx { int no_ndp; int no_ra; int no_splice; + int splice_only; int host_lo_to_ns_lo; int freebind; diff --git a/pasta.c b/pasta.c index 0ddd6b0..bab945f 100644 --- a/pasta.c +++ b/pasta.c @@ -316,6 +316,9 @@ void pasta_ns_conf(struct ctx *c) die("Couldn't bring up loopback interface in namespace: %s", strerror_(-rc)); + if (c->splice_only) + return; + /* Get or set MAC in target namespace */ if (MAC_IS_ZERO(c->guest_mac)) nl_link_get_mac(nl_sock_ns, c->pasta_ifi, c->guest_mac); diff --git a/tap.c b/tap.c index 9d1344b..eaa6111 100644 --- a/tap.c +++ b/tap.c @@ -1491,13 +1491,16 @@ static int tap_ns_tun(void *arg) */ static void tap_sock_tun_init(struct ctx *c) { - NS_CALL(tap_ns_tun, c); - if (c->fd_tap == -1) - die("Failed to set up tap device in namespace"); + if (!c->splice_only) { + NS_CALL(tap_ns_tun, c); + if (c->fd_tap == -1) + die("Failed to set up tap device in namespace"); + } pasta_ns_conf(c); - tap_start_connection(c); + if (!c->splice_only) + tap_start_connection(c); } /** -- 2.49.0

2 2

[PATCH 0/3] Register TCP flows with epoll at creation time
by Laurent Vivier 19 Jan '26

19 Jan '26

This series simplifies epoll registration by moving it to flow creation time rather than deferring it to the first event update. By registering sockets with epoll immediately (using events=0), the epoll control functions can always use EPOLL_CTL_MOD, eliminating the need to track whether a flow is already registered. Patch 1 registers both splice sockets with epoll in tcp_splice_connect() before initiating the connection, allowing tcp_splice_epoll_ctl() to always use EPOLL_CTL_MOD. Patch 2 does the same for regular TCP connections in tcp_conn_from_tap(), tcp_tap_conn_from_sock(), and tcp_flow_migrate_target(), simplifying tcp_epoll_ctl() by removing the ADD/MOD conditional logic. Patch 3 removes EPOLLFD_ID_INVALID and related infrastructure now that all flows are registered at creation: flow_in_epoll(), flow_epollid_clear(), and the defensive checks in flow_epollfd(). Thanks, Laurent Laurent Vivier (3): tcp_splice: Register fds with epoll at flow creation tcp: Register fds with epoll at flow creation flow: Remove EPOLLFD_ID_INVALID flow.c | 34 ++-------------------------------- flow.h | 6 +----- icmp.c | 1 - tcp.c | 37 ++++++++++++++----------------------- tcp_splice.c | 20 ++++++++++---------- udp_flow.c | 1 - 6 files changed, 27 insertions(+), 72 deletions(-) -- 2.52.0

2 9

[PATCH v2 0/9] Introduce multiple addresses
by Jon Maloy 19 Jan '26

19 Jan '26

This version contains what I perceive as the least controversial parts of my previous RFC series. It basically makes address handling behave like before, but now allowing multiple addresses both at the host side and the guest side. v2: - Added the earlier standalone CIDR commit to the head of the series. - Replaced the guest namespace interface subscriptions with just an address observation feature, so that it works with both PASTA and PASST. - Unified 'no_copy_addrs' and 'copy_addrs' code paths, as suggested by David G. - Multiple other changes, also based on feedback from David. - Removed the host interface subscription patches, -for now. I intend to re-add them once this series is applied. - Outstanding question: When do we add an IPv4 link local address to the guest? Only in local/opaque mode? Only when explicitly requested? Always? Jon Maloy (9): conf: Support CIDR notation for -a/--address option ip: Introduce unified multi-address data structures conf: Refactor conf_print() for multi-address support fwd: Check all configured addresses in guest accessibility functions arp: Check all configured addresses in ARP filtering conf: Allow multiple -a/--address options per address family pasta: Unify address configuration paths using address array ip: Track observed guest IPv4 addresses in unified address array ip: Track observed guest IPv6 addresses in unified address array arp.c | 12 ++- conf.c | 290 +++++++++++++++++++++++++++++++++++++----------------- dhcp.c | 8 +- dhcpv6.c | 10 +- dhcpv6.h | 2 +- fwd.c | 137 ++++++++++++++++++++------ inany.c | 29 ++++++ inany.h | 19 ++++ ip.c | 21 ++++ ip.h | 6 ++ migrate.c | 105 ++++++++++++++++++-- ndp.c | 6 +- netlink.c | 84 ++++++++++++++++ netlink.h | 5 + passt.1 | 17 +++- passt.h | 26 ++--- pasta.c | 54 ++++++---- tap.c | 116 ++++++++++++++++++---- 18 files changed, 744 insertions(+), 203 deletions(-) -- 2.52.0

2 15

[PATCH v5 00/14] Introduce forwarding table
by David Gibson 18 Jan '26

18 Jan '26

This creates a new data structure for recording our port forwarding: a table of individual forwarding rules. This is intended to replace the existing forwarding mode, map and delta structures. For now, only the delta[] array is removed. map is still used, but only for automatic forwards. Mode is still used, but only has significance during configuration. There's still a lot that can be done for flexible forwarding, but this introduces the core data structure, and does enough to fix at least one concrete defect with the current logic (bug 187). I think it would be a good point to give it a solid review and maybe merge. I'm aware that this is a very large complex series, that will be difficult to review. I think that's more or less inevitable implementing a feature as broad and complex as "flexible forwarding". If it helps at all, I'm fine if it's not reviewed all at once - I won't assume review is complete until either you say so, or I get comments or R-b on each patch. This applies on top of all 3 of my outstanding series in this area: "Allow listen functions to return fds", "Clean ups to epoll references" (v2) and "Small cleanups to splice forwarding logic". Changes in v5: * Fix coverity warning in ifname handling (2/14) Changes in v4: * Numerous cosmetic changes * Re-arrange rule hinting to avoid coverity error David Gibson (14): inany: Extend inany_ntop() to treat NULL as a fully unspecified address conf, fwd: Keep a table of our port forwarding configuration conf: Accurately record ifname and address for outbound forwards conf, fwd: Record "auto" port forwards in forwarding table fwd: Make space to store listening sockets in forward table ip: Add ipproto_name() function fwd, tcp, udp: Set up listening sockets based on forward table tcp, udp: Remove old auto-forwarding socket arrays conf, fwd: Check forwarding table for conflicting rules fwd: Generate auto-forward exclusions from socket fd tables flow, fwd: Consult rules table when forwarding a new flow from socket fwd: Remap ports based directly on forwarding rule fwd, tcp, udp: Add forwarding rule to listening socket epoll references flow, fwd: Optimise forwarding rule lookup using epoll ref when possible conf.c | 118 +++++++++------ flow.c | 55 +++++-- flow_table.h | 2 +- fwd.c | 403 ++++++++++++++++++++++++++++++++++++++++++++++--- fwd.h | 72 ++++++++- icmp.c | 2 +- inany.c | 28 +++- inany.h | 1 + ip.c | 26 ++++ ip.h | 1 + tcp.c | 156 ++----------------- tcp.h | 6 +- udp.c | 149 +++--------------- udp.h | 7 +- udp_flow.c | 14 +- udp_flow.h | 2 +- udp_internal.h | 4 +- 17 files changed, 665 insertions(+), 381 deletions(-) -- 2.52.0

2 15

passt: new version 2026_01_17.81c97f6 available
by Stefano Brivio 18 Jan '26

18 Jan '26

The new version with tag 2026_01_17.81c97f6 includes the following changes: 81c97f6 hooks/pre-push: Use mandoc(1) to get HTML anchors to command-line options a6d92ca selinux: Enable open permissions on netns directory, operations on container_var_run_t 4296a59 igmp: Remove apparently unneeded suppression fa765d5 epoll_ctl: Move u64 variant first for safer initialisation 4af3d83 treewide: Fix more pointers which can be const a54274d tcp, udp: Make {tcp,udp}_listen() return socket fds d5fd945 tcp, udp, conf: Don't silently ignore listens on unsupported IP versions c0be730 flow: Introduce flow_epoll_set() to centralize epoll operations 23da651 tcp_splice: Refactor tcp_splice_conn_epoll_events() to per-side computation e0fdfcc udp_flow: Assign socket to flow inside udp_flow_sock() ab27852 udp_flow: remove unneeded epoll_ref indirection cce0470 tcp: cleanup timer creation 5614bdc tcp: remove timer update in tcp_epoll_ctl() faab79c apparmor: Upgrade ABI version to 4.0, explicitly enable user namespace creation 2be0e79 tcp: Fix rounding issue in check for approximating window to zero b973f4a treewide: Fix places where we incorrectly indented with spaces b98a2e8 tcp: Remove some no longer used includes 35f63d2 fwd: Minor cleanup to fwd_nat_from_splice() facc736 fwd: Remove now-unnecessary handling of unspecified oaddr from splice edac476 udp_vu: Discard datagrams when RX virtqueue is not usable 9ea9dde fwd, tcp, udp: Consolidate epoll refs for listening sockets 3b55ba8 epoll_ctl: Add missing description for flowside field of epoll_ref ad5670a tcp: Remove unused tcp_epoll_ref 9437fc2 test: Include sshd-auth in mbuto guest image ac77d0c test: Handle Operating System Command escapes in terminal output accc331 treewide: Don't rely on terminator records in ip[46].dns arrays 4a0c1a6 migrate: Don't use terminator element for versions[] array 0bd2e68 util: Be more defensive about buffer overruns in read_file() 2aa6323 apparmor: Allow reading TCP RTO sysctl parameters https://passt.top/passt/log/?qt=range&q=2025_12_23.2ba9fd5..2026_01_17.81c9… Packages: - Alpine Linux: https://pkgs.alpinelinux.org/packages?name=passt - Arch Linux: https://www.archlinux.org/packages/extra/x86_64/passt/ https://archlinuxarm.org/packages/aarch64/passt https://archlinuxarm.org/packages/armv7h/passt - Chimera: https://pkgs.chimera-linux.org/packages?name=passt - Clear Linux: https://github.com/clearlinux-pkgs/passt/ - Copr (CentOS Stream, EPEL, Fedora, Mageia): https://copr.fedorainfracloud.org/coprs/sbrivio/passt/build/10031035/ permanent mirror: https://passt.top/builds/copr/0^20260117.g81c97f6/ - Debian tracker: https://tracker.debian.org/pkg/passt - Fedora updates: https://bodhi.fedoraproject.org/updates/?packages=passt - Gentoo versions: https://packages.gentoo.org/packages/net-misc/passt - GNU Guix: https://packages.guix.gnu.org/packages/passt/ - Homebrew: https://formulae.brew.sh/formula/passt - NixOS: https://github.com/NixOS/nixpkgs/tree/nixos-unstable/pkgs/by-name/pa/passt - openSUSE: https://software.opensuse.org/package/passt - OpenMandriva: https://github.com/OpenMandrivaAssociation/passt/tree/master - PLD Linux: https://git.pld-linux.org/cgi-bin/gitweb.cgi?p=packages/passt.git - Solus: https://github.com/getsolus/packages/tree/main/packages/p/passt - Ubuntu tracker: https://launchpad.net/ubuntu/+source/passt - Void Linux: https://voidlinux.org/packages/?q=passt - Static builds: - Package for other RPM-based distributions, x86_64 only: https://passt.top/builds/latest/x86_64/passt-g81c97f6-1.x86_64.rpm - x86_64 static binaries: https://passt.top/builds/latest/x86_64/ - Debian package, from x86_64 static build: https://passt.top/builds/latest/x86_64/passt_81c97f6-1_all.deb -- Stefano

1 0

[PATCH] hooks/pre-push: Use mandoc(1) to get HTML anchors to command-line options
by Stefano Brivio 17 Jan '26

17 Jan '26

It looks like man2html(1) can only build links to sections, not to TP elements. Reported-by: Erik Sjölund <erik.sjolund(a)gmail.com> Link: https://bugs.passt.top/show_bug.cgi?id=184 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- hooks/pre-push | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hooks/pre-push b/hooks/pre-push index 8dbfa5f..839b310 100755 --- a/hooks/pre-push +++ b/hooks/pre-push @@ -62,7 +62,7 @@ ssh "${USER_HOST}" "rm -f ${BIN}/*.deb" ssh "${USER_HOST}" "rm -f ${BIN}/*.rpm" scp *.deb *.rpm "${USER_HOST}:${BIN}/" -man2html -M "/" passt.1 > passt.1.html +mandoc -Thtml passt.1 > passt.1.html scp passt.1.html "${USER_HOST}:${WEB}/" for pic in passt_overview pasta_overview; do -- 2.43.0

1 0

[PATCH] selinux: Enable open permissions on netns directory, operations on container_var_run_t
by Stefano Brivio 16 Jan '26

16 Jan '26

Tuomo reports two further SELinux denials after upgrading to a passt-selinux version that includes the transition to pasta_t for containers, one I could reproduce: denied { open } for pid=3343050 comm="pasta.avx2" path="/run/user/1000/netns" dev="tmpfs" ino=51 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=1 which I didn't take care of in the previous commit, d2c5133990a7 ("selinux: Enable read and watch permissions on netns directory as well"), as it didn't appear in my quick test. But I can make pasta use "open" on the network namespace entry by simply using it to make connections. So, for that, add "open" to the existing rule for user_tmp_t:dir. Then, another one I couldn't reproduce instead: denied { write } for pid=3589324 comm="pasta.avx2" name="rootless-netns" dev="tmpfs" ino=36 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:container_var_run_t:s0 tclass=dir permissive=0 which, I think, comes from a specific combination of versions of container-selinux, Podman, and passt-selinux packages, which prevents the expected type transition on container_var_run_t unless restorecon is invoked manually, or until a reboot. Allowing the same permissions on container_var_run_t as we do on ifconfig_var_run_t is harmless, so do that to prevent this further denial. Reported-by: Tuomo Soini <tis(a)foobar.fi> Fixes: d2c5133990a7 ("selinux: Enable read and watch permissions on netns directory as well") Fixes: 7aeda16a7818 ("selinux: Transition to pasta_t in containers") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- Max, for context, this was reported at https://issues.redhat.com/browse/RHEL-136495, which is a public ticket but not necessarily a stable link as far as I know, so I'm not adding that as a Link: tag. I hope it's the last one! :) contrib/selinux/pasta.te | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 3eb58f6..fb51416 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -149,7 +149,7 @@ allow pasta_t root_t:dir mounton; manage_files_pattern(pasta_t, pasta_pid_t, pasta_pid_t) files_pid_filetrans(pasta_t, pasta_pid_t, file) -allow pasta_t user_tmp_t:dir { add_name read remove_name search watch write }; +allow pasta_t user_tmp_t:dir { add_name open read remove_name search watch write }; allow pasta_t user_tmp_t:fifo_file append; allow pasta_t user_tmp_t:file { create open write }; allow pasta_t user_tmp_t:sock_file { create unlink }; @@ -249,7 +249,9 @@ type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "netns"; type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "netns"; type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootless-netns"; type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns"; +allow pasta_t container_var_run_t:dir { add_name open rmdir write }; allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; +allow pasta_t container_var_run_t:file { create open write }; allow pasta_t ifconfig_var_run_t:file { create open write }; allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; -- 2.43.0

1 0