On Fedora 41, without "allow pasta_t unconfined_t:dir read" /usr/bin/pasta
can't open /proc/[pid]/ns , which is required by pasta_netns_quit_init() .
This patch also remove one duplicate rule "allow pasta_t nsfs_t:file read;" ,
"allow pasta_t nsfs_t:file { open read };" at line 123 is enough.
---
contrib/selinux/pasta.te | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te
index 69be081..d0ff0cc 100644
--- a/contrib/selinux/pasta.te
+++ b/contrib/selinux/pasta.te
@@ -171,7 +171,7 @@ allow pasta_t init_t:lnk_file read;
allow pasta_t init_t:unix_stream_socket connectto;
allow pasta_t init_t:dbus send_msg;
allow pasta_t init_t:system status;
-allow pasta_t unconfined_t:dir search;
+allow pasta_t unconfined_t:dir { read search };
allow pasta_t unconfined_t:file read;
allow pasta_t unconfined_t:lnk_file read;
allow pasta_t self:process { setpgid setcap };
@@ -192,8 +192,6 @@ allow pasta_t sysctl_net_t:dir search;
allow pasta_t sysctl_net_t:file { open read write };
allow pasta_t kernel_t:system module_request;
-allow pasta_t nsfs_t:file read;
-
allow pasta_t proc_t:dir mounton;
allow pasta_t proc_t:filesystem mount;
allow pasta_t net_conf_t:lnk_file read;
--
On Sun, 02 Feb 2025 19:21:21 +0000 7ppKb5bW <pONy4THS(a)protonmail.com> wrote:On Fedora 41, without "allow pasta_t unconfined_t:dir read" /usr/bin/pasta can't open /proc/[pid]/ns , which is required by pasta_netns_quit_init() . This patch also remove one duplicate rule "allow pasta_t nsfs_t:file read;" , "allow pasta_t nsfs_t:file { open read };" at line 123 is enough.Applied, thanks! I didn't notice we always ended up using the netns quit timer fallback with SELinux. :( For the future (I hope you'll contribute more, of course!) I would appreciate if you could tag your submissions with a "Signed-off-by" tag, in the sense of: https://www.kernel.org/doc/html/latest/process/submitting-patches.html#deve… contrary to the Linux kernel guidelines, we _do_ accept nicknames not related to any "known identity" such as (presumably) yours. So "Signed-off-by: nickname <your email>" would be entirely fine. This change is trivial, so it's not really needed for this one. -- Stefano
--- contrib/selinux/pasta.te | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 69be081..d0ff0cc 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -171,7 +171,7 @@ allow pasta_t init_t:lnk_file read; allow pasta_t init_t:unix_stream_socket connectto; allow pasta_t init_t:dbus send_msg; allow pasta_t init_t:system status; -allow pasta_t unconfined_t:dir search; +allow pasta_t unconfined_t:dir { read search }; allow pasta_t unconfined_t:file read; allow pasta_t unconfined_t:lnk_file read; allow pasta_t self:process { setpgid setcap }; @@ -192,8 +192,6 @@ allow pasta_t sysctl_net_t:dir search; allow pasta_t sysctl_net_t:file { open read write }; allow pasta_t kernel_t:system module_request; -allow pasta_t nsfs_t:file read; - allow pasta_t proc_t:dir mounton; allow pasta_t proc_t:filesystem mount; allow pasta_t net_conf_t:lnk_file read; --Sorry, it should be " allow pasta_t unconfined_t:dir { open read search }; "