On Tue, 04 Feb 2025 08:21:53 +0000
Prafulla Giri
type=SERVICE_START msg=audit(1738501309.082:134): pid=1 uid=0 auid=4294967295 ses=4294967295 subj=unconfined msg='unit=polkit comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'UID="root" AUID="unset" type=AVC msg=audit(1738501309.118:135): apparmor="DENIED" operation="file_mmap" class="file" profile="passt" name="/usr/bin/passt" pid=2030 comm="passt" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0FSUID="larryboy" OUID="root" type=SYSCALL msg=audit(1738501309.118:135): arch=c000003e syscall=59 success=no exit=-13 a0=7faf24035fc0 a1=7faf24035210 a2=7ffc063280d0 a3=0 items=0 ppid=1964 pid=2030 auid=1000 uid=1000 gid=1000 euid=1000 suid=1000 fsuid=1000 egid=1000 sgid=1000 fsgid=1000 tty=(none) ses=1 comm="passt" exe="/usr/bin/passt" subj=passt key=(null)ARCH=x86_64 SYSCALL=execve AUID="larryboy" UID="larryboy" GID="larryboy" EUID="larryboy" SUID="larryboy" FSUID="larryboy" EGID="larryboy" SGID="larryboy" FSGID="larryboy" type=PROCTITLE msg=audit(1738501309.118:135): proctitle="(null)" type=ANOM_ABEND msg=audit(1738501309.118:136): auid=1000 uid=1000 gid=1000 ses=1 subj=passt pid=2030 comm="passt" exe="/usr/bin/passt" sig=11 res=1AUID="larryboy" UID="larryboy" GID="larryboy"
So, it looks like passt is running as its own profile. This shouldn't happen because the libvirt profile has an own subprofile and we should see that in "profile" on the type=AVC line but... I just reproduced this! Clean Debian sid install, fresh install of libvirtd: error: internal error: Child process (passt --one-off --socket /run/user/1000/libvirt/qemu/run/passt/1-alpine-net0.socket --pid /run/user/1000/libvirt/qemu/run/passt/1-alpine-net0-passt.pid --tcp-ports 40922:22) unexpected fatal signal 11 I'll keep you posted.
https://archives.passt.top/passt-dev/20250203082210.2114348-1-sbrivio@redhat...
then:
make
and ./pasta --config-net --trace --pcap /tmp/dns.pcap -- nslookup fsf.org
$ ./pasta --config-net --trace --pcap /tmp/dns.pcap -- nslookup fsf.org # On Debian Trixie, dns.pcap attached 0.0002: No interfaces with usable IPv6 routes 0.0002: Failed to detect external interface for IPv6 0.0035: Template interface: enp1s0 (IPv4) 0.0035: Namespace interface: enp1s0 0.0035: MAC: 0.0035: host: 9a:55:9a:55:9a:55 0.0035: NAT to host 127.0.0.1: 192.168.100.1 0.0036: DHCP: 0.0036: assign: 192.168.100.157 0.0036: mask: 255.255.255.0 0.0036: router: 192.168.100.1 0.0036: DNS: 0.0036: 192.168.100.1 0.0036: DNS search list: 0.0036: . 0.0204: SO_PEEK_OFF supported 0.0204: TCP_INFO tcpi_snd_wnd field supported 0.0205: TCP_INFO tcpi_bytes_acked field supported 0.0205: TCP_INFO tcpi_min_rtt field supported 0.0205: Saving packet capture to /tmp/dns.pcap 0.0281: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001) 0.0413: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001) 0.0414: pasta: epoll event on /dev/net/tun device 16 (events: 0x00000001) 0.0414: tap: protocol 17, 192.168.100.157:56205 -> 192.168.100.1:53 (1 packet) 0.0415: Flow 0 (NEW): FREE -> NEW 0.0415: Flow 0 (INI): NEW -> INI 0.0415: Flow 0 (INI): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => ? 0.0416: Flow 0 (TGT): INI -> TGT 0.0416: Flow 0 (TGT): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => HOST [0.0.0.0]:56205 -> [192.168.100.1]:53 0.0416: Flow 0 (UDP flow): TGT -> TYPED 0.0416: Flow 0 (UDP flow): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => HOST [0.0.0.0]:56205 -> [192.168.100.1]:53 0.0417: Flow 0 (UDP flow): Side 0 hash table insert: bucket: 121236 0.0417: Flow 0 (UDP flow): TYPED -> ACTIVE 0.0417: Flow 0 (UDP flow): TAP [192.168.100.157]:56205 -> [192.168.100.1]:53 => HOST [0.0.0.0]:56205 -> [192.168.100.1]:53 0.3059: pasta: epoll event on UDP reply socket 96 (events: 0x00000001) 0.3059: Flow 0 (UDP flow): Received 1 datagrams on reply socket Server: 192.168.100.1 Address: 192.168.100.1#53
Non-authoritative answer: Name: fsf.org Address: 209.51.188.174
Okay, at least the DNS issue is fixed. I'll apply the fix in a moment, it will be available in an updated package in a while. -- Stefano