On Tue, 04 Feb 2025 08:21:53 +0000
Prafulla Giri <prafulla.giri(a)protonmail.com> wrote:
type=SERVICE_START msg=audit(1738501309.082:134):
pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=polkit
comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=?
terminal=? res=success'UID="root" AUID="unset"
type=AVC msg=audit(1738501309.118:135): apparmor="DENIED"
operation="file_mmap" class="file" profile="passt"
name="/usr/bin/passt" pid=2030 comm="passt"
requested_mask="r" denied_mask="r" fsuid=1000
ouid=0FSUID="larryboy" OUID="root"
type=SYSCALL msg=audit(1738501309.118:135): arch=c000003e syscall=59 success=no exit=-13
a0=7faf24035fc0 a1=7faf24035210 a2=7ffc063280d0 a3=0 items=0 ppid=1964 pid=2030 auid=1000
uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none)
ses=1 comm="passt" exe="/usr/bin/passt" subj=passt
key=(null)ARCH=x86_64 SYSCALL=execve AUID="larryboy" UID="larryboy"
GID="larryboy" EUID="larryboy" SUID="larryboy"
FSUID="larryboy" EGID="larryboy" SGID="larryboy"
FSGID="larryboy"
type=PROCTITLE msg=audit(1738501309.118:135): proctitle="(null)"
type=ANOM_ABEND msg=audit(1738501309.118:136): auid=1000 uid=1000 gid=1000 ses=1
subj=passt pid=2030 comm="passt" exe="/usr/bin/passt" sig=11
res=1AUID="larryboy" UID="larryboy" GID="larryboy"
So, it looks like passt is running as its own profile. This shouldn't
happen because the libvirt profile has an own subprofile and we should
see that in "profile" on the type=AVC line but... I just reproduced
this! Clean Debian sid install, fresh install of libvirtd:
error: internal error: Child process (passt --one-off --socket
/run/user/1000/libvirt/qemu/run/passt/1-alpine-net0.socket --pid
/run/user/1000/libvirt/qemu/run/passt/1-alpine-net0-passt.pid --tcp-ports 40922:22)
unexpected fatal signal 11
I'll keep you posted.
$ ./pasta --config-net --trace --pcap /tmp/dns.pcap -- nslookup
fsf.org # On
Debian Trixie, dns.pcap attached
0.0002: No interfaces with usable IPv6 routes
0.0002: Failed to detect external interface for IPv6
0.0035: Template interface: enp1s0 (IPv4)
0.0035: Namespace interface: enp1s0
0.0035: MAC:
0.0035: host: 9a:55:9a:55:9a:55
0.0035: NAT to host 127.0.0.1: 192.168.100.1
0.0036: DHCP:
0.0036: assign: 192.168.100.157
0.0036: mask: 255.255.255.0
0.0036: router: 192.168.100.1
0.0036: DNS:
0.0036: 192.168.100.1
0.0036: DNS search list:
0.0036: .
0.0204: SO_PEEK_OFF supported
0.0204: TCP_INFO tcpi_snd_wnd field supported
0.0205: TCP_INFO tcpi_bytes_acked field supported
0.0205: TCP_INFO tcpi_min_rtt field supported
0.0205: Saving packet capture to /tmp/dns.pcap
0.0281: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001)
0.0413: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001)
0.0414: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001)
0.0414: tap: protocol 17, 192.168.100.157:56205 -> 192.168.100.1:53 (1 packet)
0.0415: Flow 0 (NEW): FREE -> NEW
0.0415: Flow 0 (INI): NEW -> INI
0.0415: Flow 0 (INI): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => ?
0.0416: Flow 0 (TGT): INI -> TGT
0.0416: Flow 0 (TGT): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => HOST
[0.0.0.0]:56205 -> [192.168.100.1]:53
0.0416: Flow 0 (UDP flow): TGT -> TYPED
0.0416: Flow 0 (UDP flow): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 =>
HOST [0.0.0.0]:56205 -> [192.168.100.1]:53
0.0417: Flow 0 (UDP flow): Side 0 hash table insert: bucket: 121236
0.0417: Flow 0 (UDP flow): TYPED -> ACTIVE
0.0417: Flow 0 (UDP flow): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 =>
HOST [0.0.0.0]:56205 -> [192.168.100.1]:53
0.3059: pasta: epoll event on UDP reply socket 96 (events: 0x00000001)
0.3059: Flow 0 (UDP flow): Received 1 datagrams on reply socket
Server: 192.168.100.1
Address: 192.168.100.1#53
Non-authoritative answer:
Name:
fsf.org
Address: 209.51.188.174
Okay, at least the DNS issue is fixed. I'll apply the fix in a moment,
it will be available in an updated package in a while.
--
Stefano