On Sun, 02 Feb 2025 19:21:21 +0000 7ppKb5bW <pONy4THS(a)protonmail.com> wrote:On Fedora 41, without "allow pasta_t unconfined_t:dir read" /usr/bin/pasta can't open /proc/[pid]/ns , which is required by pasta_netns_quit_init() . This patch also remove one duplicate rule "allow pasta_t nsfs_t:file read;" , "allow pasta_t nsfs_t:file { open read };" at line 123 is enough.Applied, thanks! I didn't notice we always ended up using the netns quit timer fallback with SELinux. :( For the future (I hope you'll contribute more, of course!) I would appreciate if you could tag your submissions with a "Signed-off-by" tag, in the sense of: https://www.kernel.org/doc/html/latest/process/submitting-patches.html#deve… contrary to the Linux kernel guidelines, we _do_ accept nicknames not related to any "known identity" such as (presumably) yours. So "Signed-off-by: nickname <your email>" would be entirely fine. This change is trivial, so it's not really needed for this one. -- Stefano