Since commit b0e450aa8500 ("pasta: Detach mount namespace, (re)mount
procfs before spawning command"), we need to explicitly permit mount
of /proc, and access to entries under /proc/PID/net (after remount,
that's what AppArmor sees as path).
Fixes: b0e450aa8500 ("pasta: Detach mount namespace, (re)mount procfs before spawning command")
Signed-off-by: Stefano Brivio
---
contrib/apparmor/abstractions/pasta | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta
index 9cba25a..05c5d46 100644
--- a/contrib/apparmor/abstractions/pasta
+++ b/contrib/apparmor/abstractions/pasta
@@ -15,11 +15,18 @@
include
+ mount "" -> "/proc/",
+
@{PROC}/net/tcp r, # procfs_scan_listen(), util.c
@{PROC}/net/tcp6 r,
@{PROC}/net/udp r,
@{PROC}/net/udp6 r,
+ @{PROC}/@{pid}/net/tcp r, # procfs_scan_listen(), util.c
+ @{PROC}/@{pid}/net/tcp6 r,
+ @{PROC}/@{pid}/net/udp r,
+ @{PROC}/@{pid}/net/udp6 r,
+
@{run}/user/@{uid}/netns/* r, # pasta_open_ns(), pasta.c
@{PROC}/[0-9]*/ns/net r, # pasta_wait_for_ns(),
--
2.39.2