Starting from commit 7bf1595c9242 ("isolation: Don't create our userns as nobody"), we unconditionally set uidmap and gidmap in the detached user namespace. Allow that in SELinux rules. We also need to allow explicit access to the related files. While at it, add the matching class requirements in pasta.te, which I forgot (harmless as they were indirectly required, but not really correct). Link: https://bodhi.fedoraproject.org/updates/FEDORA-2026-3a8fb909da#comment-47905... Fixes: 71b74e924426 ("isolation: Don't create our userns as nobody") Signed-off-by: Stefano Brivio --- ...pen-permissions-on-netns-directory-o.patch | 72 +++++ contrib/selinux/passt.te | 7 +- contrib/selinux/pasta.te | 2 +- contrib/selinux/pasta.te.orig | 266 ++++++++++++++++++ 4 files changed, 344 insertions(+), 3 deletions(-) create mode 100644 contrib/selinux/0001-selinux-Enable-open-permissions-on-netns-directory-o.patch create mode 100644 contrib/selinux/pasta.te.orig diff --git a/contrib/selinux/0001-selinux-Enable-open-permissions-on-netns-directory-o.patch b/contrib/selinux/0001-selinux-Enable-open-permissions-on-netns-directory-o.patch new file mode 100644 index 0000000..492d0ab --- /dev/null +++ b/contrib/selinux/0001-selinux-Enable-open-permissions-on-netns-directory-o.patch @@ -0,0 +1,72 @@ +From 2a7824f0a4863f0cee33370d994e28c584d6922c Mon Sep 17 00:00:00 2001 +From: Stefano Brivio +Date: Fri, 16 Jan 2026 16:48:46 +0100 +Subject: [PATCH] selinux: Enable open permissions on netns directory, + operations on container_var_run_t + +Tuomo reports two further SELinux denials after upgrading to a +passt-selinux version that includes the transition to pasta_t for +containers, one I could reproduce: + + denied { open } for pid=3343050 comm="pasta.avx2" path="/run/user/1000/netns" dev="tmpfs" ino=51 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_tmp_t:s0 tclass=dir permissive=1 + +which I didn't take care of in the previous commit, d2c5133990a7 +("selinux: Enable read and watch permissions on netns directory as +well"), as it didn't appear in my quick test. But I can make pasta use +"open" on the network namespace entry by simply using it to make +connections. + +So, for that, add "open" to the existing rule for user_tmp_t:dir. + +Then, another one I couldn't reproduce instead: + + denied { write } for pid=3589324 comm="pasta.avx2" name="rootless-netns" dev="tmpfs" ino=36 scontext=unconfined_u:unconfined_r:pasta_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:container_var_run_t:s0 tclass=dir permissive=0 + +which, I think, comes from a specific combination of versions of +container-selinux, Podman, and passt-selinux packages, which +prevents the expected type transition on container_var_run_t unless +restorecon is invoked manually, or until a reboot. + +Allowing the same permissions on container_var_run_t as we do on +ifconfig_var_run_t is harmless, so do that to prevent this further +denial. + +Reported-by: Tuomo Soini +Fixes: d2c5133990a7 ("selinux: Enable read and watch permissions on netns directory as well") +Fixes: 7aeda16a7818 ("selinux: Transition to pasta_t in containers") +Signed-off-by: Stefano Brivio +--- +Max, for context, this was reported at +https://issues.redhat.com/browse/RHEL-136495, which is a public +ticket but not necessarily a stable link as far as I know, so I'm +not adding that as a Link: tag. I hope it's the last one! :) + + contrib/selinux/pasta.te | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te +index 3eb58f6..fb51416 100644 +--- a/contrib/selinux/pasta.te ++++ b/contrib/selinux/pasta.te +@@ -149,7 +149,7 @@ allow pasta_t root_t:dir mounton; + manage_files_pattern(pasta_t, pasta_pid_t, pasta_pid_t) + files_pid_filetrans(pasta_t, pasta_pid_t, file) + +-allow pasta_t user_tmp_t:dir { add_name read remove_name search watch write }; ++allow pasta_t user_tmp_t:dir { add_name open read remove_name search watch write }; + allow pasta_t user_tmp_t:fifo_file append; + allow pasta_t user_tmp_t:file { create open write }; + allow pasta_t user_tmp_t:sock_file { create unlink }; +@@ -249,7 +249,9 @@ type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "netns"; + type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "netns"; + type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootless-netns"; + type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns"; ++allow pasta_t container_var_run_t:dir { add_name open rmdir write }; + allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; ++allow pasta_t container_var_run_t:file { create open write }; + allow pasta_t ifconfig_var_run_t:file { create open write }; + allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; + +-- +2.43.0 + diff --git a/contrib/selinux/passt.te b/contrib/selinux/passt.te index 6995df8..e540473 100644 --- a/contrib/selinux/passt.te +++ b/contrib/selinux/passt.te @@ -23,6 +23,7 @@ require { type user_home_t; type tmpfs_t; type root_t; + type nsfs_t; # Workaround: passt --vhost-user needs to map guest memory, but # libvirt doesn't maintain its own policy, which makes updates @@ -61,7 +62,7 @@ require { type sysctl_net_t; class capability { sys_tty_config setuid setgid }; - class cap_userns { setpcap sys_admin sys_ptrace }; + class cap_userns { setpcap setgid setuid sys_admin sys_ptrace }; class user_namespace create; } @@ -104,11 +105,13 @@ allow syslogd_t self:cap_userns sys_ptrace; allow passt_t self:process setcap; allow passt_t self:capability { sys_tty_config setpcap net_bind_service setuid setgid}; -allow passt_t self:cap_userns { setpcap sys_admin sys_ptrace }; +allow passt_t self:cap_userns { setgid setuid setpcap sys_admin sys_ptrace }; allow passt_t self:user_namespace create; auth_read_passwd(passt_t) +allow passt_t nsfs_t:file { open read }; + allow passt_t proc_net_t:file read; allow passt_t tmp_t:sock_file { create unlink write }; allow passt_t self:netlink_route_socket { bind create nlmsg_read read write setopt }; diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index 9394f97..d0c9c32 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -87,7 +87,7 @@ require { type init_t; class capability { sys_tty_config setuid setgid }; - class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin }; + class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin setgid setuid }; class user_namespace create; # Container requires diff --git a/contrib/selinux/pasta.te.orig b/contrib/selinux/pasta.te.orig new file mode 100644 index 0000000..ff74dd7 --- /dev/null +++ b/contrib/selinux/pasta.te.orig @@ -0,0 +1,266 @@ +# SPDX-License-Identifier: GPL-2.0-or-later +# +# PASTA - Pack A Subtle Tap Abstraction +# for network namespace/tap device mode +# +# contrib/selinux/pasta.te - SELinux profile: Type Enforcement for pasta +# +# Copyright (c) 2022 Red Hat GmbH +# Author: Stefano Brivio + +policy_module(pasta, 0.1) + +require { + type unconfined_t; + role unconfined_r; + class process transition; + + type bin_t; + type user_home_t; + type user_home_dir_t; + type user_tmp_t; + type fs_t; + type tmp_t; + type tmpfs_t; + type root_t; + type nsfs_t; + + class file { ioctl getattr setattr create read write unlink open relabelto execute_no_trans map execute }; + class dir { getattr search read write add_name remove_name mounton watch }; + class chr_file { append read write open getattr ioctl }; + class filesystem { getattr mount unmount }; + class lnk_file read; + + type console_device_t; + type user_devpts_t; + type devlog_t; + type syslogd_t; + type var_run_t; + class unix_dgram_socket { create connect sendto }; + + type net_conf_t; + type proc_net_t; + type node_t; + class tcp_socket { create accept listen name_bind name_connect }; + class udp_socket { create accept listen name_bind }; + class icmp_socket { bind create name_bind node_bind setopt read write }; + class sock_file { create unlink write }; + class unix_stream_socket connectto; + + type ifconfig_var_run_t; + class netlink_route_socket { bind create nlmsg_read nlmsg_write setopt }; + type tun_tap_device_t; + type sysctl_net_t; + class tun_socket create; + type user_tty_device_t; + + attribute port_type; + type port_t; + type http_port_t; + type http_cache_port_t; + type ssh_port_t; + type reserved_port_t; + type unreserved_port_t; + type dns_port_t; + type dhcpc_port_t; + type chronyd_port_t; + type llmnr_port_t; + + type hostname_exec_t; + type system_dbusd_var_run_t; + type system_dbusd_t; + type systemd_hostnamed_t; + type systemd_systemctl_exec_t; + class dbus send_msg; + class system module_request; + class system status; + + type kernel_t; + class process setpgid; + type shell_exec_t; + type ifconfig_exec_t; + type netutils_exec_t; + type ping_exec_t; + type ifconfig_t; + type netutils_t; + type ping_t; + type init_t; + + class capability { sys_tty_config setuid setgid }; + class cap_userns { setpcap sys_admin sys_ptrace net_bind_service net_admin }; + class user_namespace create; + + # Container requires + attribute_role usernetctl_roles; + role container_user_r; + role staff_r; + role user_r; + type container_runtime_t; + type container_var_run_t; + type container_t; + type systemd_user_runtimedir_t; +} + +type pasta_t; +domain_type(pasta_t); +type pasta_exec_t; +files_type(pasta_exec_t); +type pasta_log_t; +logging_log_file(pasta_log_t); +type pasta_pid_t; +files_pid_file(pasta_pid_t); + +type pasta_port_t; +typeattribute pasta_port_t port_type; + +role unconfined_r types pasta_t; + +allow pasta_t pasta_exec_t : file { ioctl read getattr lock execute execute_no_trans entrypoint open } ; +type_transition unconfined_t pasta_exec_t : process pasta_t; +allow unconfined_t pasta_t : process transition ; + +init_daemon_domain(pasta_t, pasta_exec_t) + +allow pasta_t self:capability { setpcap net_bind_service sys_tty_config dac_read_search net_admin sys_resource setuid setgid }; +allow pasta_t self:cap_userns { setpcap sys_admin sys_ptrace net_admin net_bind_service }; +# pasta only calls setuid and setgid with the current UID and GID, so this +# denial is harmless. See https://bugzilla.redhat.com/show_bug.cgi?id=2330512#c10 +dontaudit pasta_t self:cap_userns { setgid setuid }; +allow pasta_t self:user_namespace create; + +auth_read_passwd(pasta_t) + +domain_auto_trans(pasta_t, bin_t, unconfined_t); +domain_auto_trans(pasta_t, shell_exec_t, unconfined_t); +domain_auto_trans(pasta_t, ifconfig_exec_t, ifconfig_t); +domain_auto_trans(pasta_t, netutils_exec_t, netutils_t); +domain_auto_trans(pasta_t, ping_exec_t, ping_t); + +allow pasta_t nsfs_t:file { open read }; + +allow pasta_t user_home_t:dir { getattr search }; +allow pasta_t user_home_t:file { open read getattr setattr execute execute_no_trans map}; +allow pasta_t user_home_dir_t:dir { search getattr open add_name read write }; +allow pasta_t user_home_dir_t:file { create open read write }; +allow pasta_t tmp_t:dir { add_name mounton remove_name write }; +allow pasta_t tmpfs_t:filesystem { getattr mount }; +allow pasta_t fs_t:filesystem unmount; +allow pasta_t root_t:dir mounton; +manage_files_pattern(pasta_t, pasta_pid_t, pasta_pid_t) +files_pid_filetrans(pasta_t, pasta_pid_t, file) + +allow pasta_t user_tmp_t:dir { add_name open read remove_name search watch write }; +allow pasta_t user_tmp_t:fifo_file append; +allow pasta_t user_tmp_t:file { create open write }; +allow pasta_t user_tmp_t:sock_file { create unlink }; + +allow pasta_t console_device_t:chr_file { open write getattr ioctl }; +allow pasta_t user_devpts_t:chr_file { getattr read write ioctl }; +logging_send_syslog_msg(pasta_t) +allow syslogd_t self:cap_userns sys_ptrace; + +allow pasta_t proc_net_t:file { open read }; +allow pasta_t self:netlink_route_socket { bind create nlmsg_read nlmsg_write setopt read write }; +kernel_search_network_sysctl(pasta_t) + +sysnet_read_config(pasta_t) + +allow pasta_t tmp_t:sock_file { create unlink write }; + +allow pasta_t self:tcp_socket create_stream_socket_perms; +corenet_tcp_sendrecv_generic_node(pasta_t) +corenet_tcp_bind_generic_node(pasta_t) +allow pasta_t container_runtime_t:dir { open read search }; +allow pasta_t container_runtime_t:fifo_file { getattr write }; +allow pasta_t container_runtime_t:file read; +allow pasta_t container_runtime_t:lnk_file read; +allow pasta_t container_t:lnk_file read; +allow pasta_t pasta_port_t:tcp_socket { name_bind name_connect }; +allow pasta_t pasta_port_t:udp_socket { name_bind }; +allow pasta_t http_port_t:tcp_socket { name_bind name_connect }; +allow pasta_t chronyd_port_t:udp_socket name_bind; +allow pasta_t dhcpc_port_t:udp_socket name_bind; +allow pasta_t dns_port_t:tcp_socket name_bind; +allow pasta_t dns_port_t:udp_socket name_bind; +allow pasta_t ssh_port_t:tcp_socket name_bind; +allow pasta_t self:udp_socket create_stream_socket_perms; +allow pasta_t reserved_port_t:udp_socket name_bind; +allow pasta_t llmnr_port_t:tcp_socket name_bind; +allow pasta_t llmnr_port_t:udp_socket name_bind; +allow pasta_t http_cache_port_t:tcp_socket { name_bind name_connect }; +allow pasta_t unreserved_port_t:udp_socket name_bind; +corenet_udp_sendrecv_generic_node(pasta_t) +corenet_udp_bind_generic_node(pasta_t) +allow pasta_t node_t:icmp_socket { name_bind node_bind }; +allow pasta_t self:icmp_socket { bind create setopt read write }; + +allow pasta_t init_t:dir search; +allow pasta_t init_t:file { getattr open read }; +allow pasta_t init_t:lnk_file read; +allow pasta_t init_t:unix_stream_socket connectto; +allow pasta_t init_t:dbus send_msg; +allow pasta_t init_t:system status; +allow pasta_t unconfined_t:dir { read search }; +allow pasta_t unconfined_t:file read; +allow pasta_t unconfined_t:lnk_file read; +allow pasta_t self:process { setpgid setcap }; +allow pasta_t shell_exec_t:file { execute execute_no_trans map }; + +allow pasta_t hostname_exec_t:file { execute execute_no_trans getattr open read map }; +allow pasta_t system_dbusd_t:unix_stream_socket connectto; +allow pasta_t system_dbusd_t:dbus send_msg; +allow pasta_t system_dbusd_var_run_t:dir search; +allow pasta_t system_dbusd_var_run_t:sock_file write; +allow pasta_t systemd_hostnamed_t:dbus send_msg; +allow pasta_t systemd_systemctl_exec_t:file { execute execute_no_trans getattr open read map }; + +allow pasta_t ifconfig_var_run_t:dir { read search watch }; +allow pasta_t self:tun_socket create; +allow pasta_t tun_tap_device_t:chr_file { ioctl open read write }; +allow pasta_t sysctl_net_t:dir search; +allow pasta_t sysctl_net_t:file { open read write }; +allow pasta_t kernel_t:system module_request; + +allow pasta_t proc_t:dir mounton; +allow pasta_t proc_t:filesystem mount; +allow pasta_t proc_net_t:lnk_file read; + +allow pasta_t unconfined_t:process { noatsecure rlimitinh siginh }; +allow pasta_t ifconfig_t:process { noatsecure rlimitinh siginh }; +allow pasta_t netutils_t:process { noatsecure rlimitinh siginh }; +allow pasta_t ping_t:process { noatsecure rlimitinh siginh }; +allow pasta_t user_tty_device_t:chr_file { append read write }; +allow pasta_t user_devpts_t:chr_file { append read write }; + +# Allow network administration commands for non-privileged users +roleattribute container_user_r usernetctl_roles; +roleattribute staff_r usernetctl_roles; +roleattribute user_r usernetctl_roles; +role usernetctl_roles types pasta_t; + +# Make pasta in a container run under the pasta_t context +type_transition container_runtime_t pasta_exec_t : process pasta_t; +allow container_runtime_t pasta_t:process transition; + +# Label the user network namespace files +# Note: Podman files used to be user_tmp_t but are now container_var_run_t since +# https://github.com/containers/container-selinux/pull/405 +type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "netns"; +type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "netns"; +type_transition container_runtime_t user_tmp_t : dir ifconfig_var_run_t "rootless-netns"; +type_transition container_runtime_t container_var_run_t : dir ifconfig_var_run_t "rootless-netns"; +allow pasta_t container_var_run_t:dir { add_name open rmdir write }; +allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; +allow pasta_t container_var_run_t:file { create open write }; +allow pasta_t ifconfig_var_run_t:file { create open write }; +allow pasta_t container_var_run_t:sock_file { getattr create open read write }; +allow pasta_t ifconfig_var_run_t:sock_file { getattr create open read write }; +allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; + +# Allow pasta to bind to any port +bool pasta_bind_all_ports true; +if (pasta_bind_all_ports) { + allow pasta_t port_type:icmp_socket { accept getopt name_bind }; + allow pasta_t port_type:tcp_socket { accept getopt name_bind name_connect }; + allow pasta_t port_type:udp_socket { accept getopt name_bind }; +} -- 2.43.0