Commit 7bf1595c9242 ("isolation: Don't create our userns as nobody") changed the procedure user namespaces are detached, also for passt, and adds unconditional setting of UID and GID maps. This needs AppArmor adjustments: - rules to access gid_map, uid_map, and setgroups entries in procfs now need to be enabled for passt as well, not just for pasta: move them to the passt abstraction (which is included from the pasta abstraction) - we now need to open a user namespace originally detached by a separate holder process, which requires us to open procfs entries that are disconnected (from an AppArmor perspective) from the original namespace: add the attach_disconnected flag to the profile for passt as well (this was already the case for pasta). This isn't ideal but there doesn't seem any way around it: opening the namespace from the holder process itself doesn't help either. We'll need to add this flag also in passt subprofiles for guestfs-tools (maintained in Debian) and libvirtd (which only applies when guests are started as root for the moment, maintained by libvirt upstream). Reported-by: Michal Humpula Link: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1149683 Signed-off-by: Stefano Brivio --- contrib/apparmor/abstractions/passt | 4 +++- contrib/apparmor/abstractions/pasta | 4 ---- contrib/apparmor/usr.bin.passt | 2 +- 3 files changed, 4 insertions(+), 6 deletions(-) diff --git a/contrib/apparmor/abstractions/passt b/contrib/apparmor/abstractions/passt index f4570c1..0aeb19d 100644 --- a/contrib/apparmor/abstractions/passt +++ b/contrib/apparmor/abstractions/passt @@ -34,7 +34,9 @@ pivot_root "/tmp/" -> "/tmp/", umount "/", - owner @{PROC}/@{pid}/uid_map r, # conf_ugid() + owner @{PROC}/@{pid}/gid_map w, # make_ugid_map() + owner @{PROC}/@{pid}/setgroups w, + owner @{PROC}/@{pid}/uid_map rw, @{PROC}/sys/net/ipv4/ip_local_port_range r, # fwd_probe_ephemeral() diff --git a/contrib/apparmor/abstractions/pasta b/contrib/apparmor/abstractions/pasta index 251d4a2..89fa427 100644 --- a/contrib/apparmor/abstractions/pasta +++ b/contrib/apparmor/abstractions/pasta @@ -35,10 +35,6 @@ /dev/net/tun rw, # tap_ns_tun(), tap.c - owner @{PROC}/@{pid}/gid_map w, # pasta_start_ns(), conf_ugid() - owner @{PROC}/@{pid}/setgroups w, - owner @{PROC}/@{pid}/uid_map rw, - owner @{PROC}/sys/net/ipv4/ping_group_range w, # pasta_spawn_cmd(), pasta.c /{usr/,}bin/** Ux, diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index da49e37..ccc2ea9 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -15,7 +15,7 @@ abi , include -profile passt /usr/bin/passt{,.avx2} { +profile passt /usr/bin/passt{,.avx2} flags=(attach_disconnected) { include include # tap_sock_unix_open(), -- 2.43.0