November 2025 - dev

[PATCH] seccomp.sh: Quote tr character ranges to prevent glob expansion
by Laurent Vivier 14 Nov '25

14 Nov '25

we use [a-z] and [A-Z] patterns with 'tr', but if there are files with names matching these patterns they will be replaced by the name of the file and seccomp.h will not be generated correctly: $ rm seccomp.h $ touch a b $ make tr: extra operand '[A-Z]' Try 'tr --help' for more information. seccomp profile passt allows: accept accept4 bind clock_gettime close connect epoll_ctl epoll_pwait epoll_wait exit_group fallocate fcntl fsync ftruncate getsockname getsockopt listen lseek read recvfrom recvmmsg recvmsg sendmmsg sendmsg sendto ... cc -Wall -Wextra -Wno-format-zero-length -Wformat-security -pedantic -std=c11 -D_XOPEN_SOURCE=700 -D_GNU_SOURCE -D_FORTIFY_SOURCE=2 -O2 -pie -fPIE -DPAGE_SIZE=4096 -DVERSION="2025_09_19.623dbf6-54-gf6b6118fcabd" -DDUAL_STACK_SOCKETS=1 -DHAS_GETRANDOM -fstack-protector-strong arch.c arp.c checksum.c conf.c dhcp.c dhcpv6.c epoll_ctl.c flow.c fwd.c icmp.c igmp.c inany.c iov.c ip.c isolation.c lineread.c log.c mld.c ndp.c netlink.c migrate.c packet.c passt.c pasta.c pcap.c pif.c repair.c tap.c tcp.c tcp_buf.c tcp_splice.c tcp_vu.c udp.c udp_flow.c udp_vu.c util.c vhost_user.c virtio.c vu_common.c -o passt In file included from isolation.c:83: seccomp.h:11:45: error: 'AUDIT_ARCH_' undeclared here (not in a function); did you mean 'AUDIT_ARCH'? 11 | BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, AUDIT_ARCH_, 0, 80), | ^~~~~~~~~~~ Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- seccomp.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/seccomp.sh b/seccomp.sh index a7bc417b9f6b..ba92b29d9a29 100755 --- a/seccomp.sh +++ b/seccomp.sh @@ -22,7 +22,7 @@ IN="$@" [ -z "${ARCH}" ] && ARCH="$(uname -m)" [ -z "${CC}" ] && CC="cc" -AUDIT_ARCH="AUDIT_ARCH_$(echo ${ARCH} | tr [a-z] [A-Z] \ +AUDIT_ARCH="AUDIT_ARCH_$(echo ${ARCH} | tr '[a-z]' '[A-Z]' \ | sed 's/^ARM.*/ARM/' \ | sed 's/I[456]86/I386/' \ | sed 's/PPC64/PPC/' \ -- 2.51.0

3 7

[PATCH] udp: Use IP_FREEBIND for flow sockets as well as listening sockets
by David Gibson 14 Nov '25

14 Nov '25

The --freebind option allows pasta to listen on addresses that aren't registered on the host, which has a number of use cases. However, we omitted this option for UDP "flow sockets" which are created once a flow is started, connect()ed specifically to the peer. Flow sockets are also bound, and if the peer has contacted a freebind address, we need IP_FREEBIND to do so. Link: https://bugs.passt.top/show_bug.cgi?id=174 Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) I'm still waiting on confirmation from the reporter that this actually fixes bug 174. However, I'm pretty sure this is _a_ correct fix, whether or not it's a complete fix for the issue seen by the reporter. diff --git a/util.c b/util.c index 44c21a3e..ab23463b 100644 --- a/util.c +++ b/util.c @@ -67,9 +67,8 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, freebind = c->freebind; break; case EPOLL_TYPE_UDP_LISTEN: - freebind = c->freebind; - /* fallthrough */ case EPOLL_TYPE_UDP: + freebind = c->freebind; proto = IPPROTO_UDP; socktype = SOCK_DGRAM | SOCK_NONBLOCK; break; -- 2.51.1

2 2

[PATCH v3 1/8] inany: Let length of sockaddr_inany be implicit from the family
by David Gibson 13 Nov '25

13 Nov '25

sockaddr_inany can contain either an IPv4 or IPv6 socket address, so the relevant length for bind() or connect() can vary. In pif_sockaddr() we return that length, and in sock_l4_sa() we take it as an extra parameter. However, sockaddr_inany always contains exactly a sockaddr_in or a sockaddr_in6 each with a fixed size. Therefore we can derive the relevant length from the family, and don't need to pass it around separately. Make a tiny helper to get the relevant address length, and update all interfaces to use that approach instead. In the process, fix a buglet in tcp_flow_repair_bind(): we passed sizeof(union sockaddr_inany) to bind() instead of the specific length for the address family. Since the sizeof() is always longer than the specific length, this is probably fine, but not theoretically correct. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- flow.c | 17 +++++++---------- icmp.c | 3 ++- inany.h | 18 ++++++++++++++++++ pif.c | 14 ++++---------- pif.h | 2 +- tcp.c | 20 +++++++++----------- tcp_splice.c | 5 ++--- udp.c | 8 +++----- util.c | 9 ++++----- util.h | 5 +++-- 10 files changed, 53 insertions(+), 48 deletions(-) diff --git a/flow.c b/flow.c index feefda3c..9926f408 100644 --- a/flow.c +++ b/flow.c @@ -170,8 +170,7 @@ struct flowside_sock_args { int fd; int err; enum epoll_type type; - const struct sockaddr *sa; - socklen_t sl; + const union sockaddr_inany *sa; const char *path; uint32_t data; }; @@ -187,7 +186,7 @@ static int flowside_sock_splice(void *arg) ns_enter(a->c); - a->fd = sock_l4_sa(a->c, a->type, a->sa, a->sl, NULL, + a->fd = sock_l4_sa(a->c, a->type, a->sa, NULL, a->sa->sa_family == AF_INET6, a->data); a->err = errno; @@ -209,11 +208,10 @@ int flowside_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, { const char *ifname = NULL; union sockaddr_inany sa; - socklen_t sl; ASSERT(pif_is_socket(pif)); - pif_sockaddr(c, &sa, &sl, pif, &tgt->oaddr, tgt->oport); + pif_sockaddr(c, &sa, pif, &tgt->oaddr, tgt->oport); switch (pif) { case PIF_HOST: @@ -224,13 +222,13 @@ int flowside_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, else if (sa.sa_family == AF_INET6) ifname = c->ip6.ifname_out; - return sock_l4_sa(c, type, &sa, sl, ifname, + return sock_l4_sa(c, type, &sa, ifname, sa.sa_family == AF_INET6, data); case PIF_SPLICE: { struct flowside_sock_args args = { .c = c, .type = type, - .sa = &sa.sa, .sl = sl, .data = data, + .sa = &sa, .data = data, }; NS_CALL(flowside_sock_splice, &args); errno = args.err; @@ -259,10 +257,9 @@ int flowside_connect(const struct ctx *c, int s, uint8_t pif, const struct flowside *tgt) { union sockaddr_inany sa; - socklen_t sl; - pif_sockaddr(c, &sa, &sl, pif, &tgt->eaddr, tgt->eport); - return connect(s, &sa.sa, sl); + pif_sockaddr(c, &sa, pif, &tgt->eaddr, tgt->eport); + return connect(s, &sa.sa, socklen_inany(&sa)); } /** flow_log_ - Log flow-related message diff --git a/icmp.c b/icmp.c index 6dffafb0..62b3bed8 100644 --- a/icmp.c +++ b/icmp.c @@ -301,8 +301,9 @@ int icmp_tap_handler(const struct ctx *c, uint8_t pif, sa_family_t af, ASSERT(flow_proto[pingf->f.type] == proto); pingf->ts = now->tv_sec; - pif_sockaddr(c, &sa, &msh.msg_namelen, PIF_HOST, &tgt->eaddr, 0); + pif_sockaddr(c, &sa, PIF_HOST, &tgt->eaddr, 0); msh.msg_name = &sa; + msh.msg_namelen = socklen_inany(&sa); msh.msg_iov = iov; msh.msg_iovlen = cnt; msh.msg_control = NULL; diff --git a/inany.h b/inany.h index 7ca5cbd3..e3cae2a8 100644 --- a/inany.h +++ b/inany.h @@ -67,6 +67,24 @@ union sockaddr_inany { struct sockaddr_in6 sa6; }; +/** socklen_inany() - Return relevant size of an sockaddr_inany + * @sa: sockaddr_iany socket address + * + * Returns the correct socket address length to pass to bind() or connect() with + * @sa, based on whether it is an IPv4 or IPv6 address. + */ +static inline socklen_t socklen_inany(const union sockaddr_inany *sa) +{ + switch (sa->sa_family) { + case AF_INET: + return sizeof(sa->sa4); + case AF_INET6: + return sizeof(sa->sa6); + default: + ASSERT(0); + } +} + /** inany_v4 - Extract IPv4 address, if present, from IPv[46] address * @addr: IPv4 or IPv6 address * diff --git a/pif.c b/pif.c index 592fafaa..31723b29 100644 --- a/pif.c +++ b/pif.c @@ -29,12 +29,11 @@ static_assert(ARRAY_SIZE(pif_type_str) == PIF_NUM_TYPES, /** pif_sockaddr() - Construct a socket address suitable for an interface * @c: Execution context * @sa: Pointer to sockaddr to fill in - * @sl: Updated to relevant length of initialised @sa * @pif: Interface to create the socket address * @addr: IPv[46] address * @port: Port (host byte order) */ -void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, socklen_t *sl, +void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, uint8_t pif, const union inany_addr *addr, in_port_t port) { const struct in_addr *v4 = inany_v4(addr); @@ -46,7 +45,6 @@ void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, socklen_t *sl, sa->sa4.sin_addr = *v4; sa->sa4.sin_port = htons(port); memset(&sa->sa4.sin_zero, 0, sizeof(sa->sa4.sin_zero)); - *sl = sizeof(sa->sa4); } else { sa->sa_family = AF_INET6; sa->sa6.sin6_addr = addr->a6; @@ -56,7 +54,6 @@ void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, socklen_t *sl, else sa->sa6.sin6_scope_id = 0; sa->sa6.sin6_flowinfo = 0; - *sl = sizeof(sa->sa6); } } @@ -83,7 +80,6 @@ int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, .sa6.sin6_addr = in6addr_any, .sa6.sin6_port = htons(port), }; - socklen_t sl; ASSERT(pif_is_socket(pif)); @@ -94,10 +90,8 @@ int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, } if (!addr) - return sock_l4_sa(c, type, &sa, sizeof(sa.sa6), - ifname, false, data); + return sock_l4_sa(c, type, &sa, ifname, false, data); - pif_sockaddr(c, &sa, &sl, pif, addr, port); - return sock_l4_sa(c, type, &sa, sl, - ifname, sa.sa_family == AF_INET6, data); + pif_sockaddr(c, &sa, pif, addr, port); + return sock_l4_sa(c, type, &sa, ifname, sa.sa_family == AF_INET6, data); } diff --git a/pif.h b/pif.h index f029282b..0f7f6672 100644 --- a/pif.h +++ b/pif.h @@ -57,7 +57,7 @@ static inline bool pif_is_socket(uint8_t pif) return pif == PIF_HOST || pif == PIF_SPLICE; } -void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, socklen_t *sl, +void pif_sockaddr(const struct ctx *c, union sockaddr_inany *sa, uint8_t pif, const union inany_addr *addr, in_port_t port); int pif_sock_l4(const struct ctx *c, enum epoll_type type, uint8_t pif, const union inany_addr *addr, const char *ifname, diff --git a/tcp.c b/tcp.c index 0f9e9b3f..d63a16bf 100644 --- a/tcp.c +++ b/tcp.c @@ -1443,12 +1443,11 @@ static void tcp_bind_outbound(const struct ctx *c, { const struct flowside *tgt = &conn->f.side[TGTSIDE]; union sockaddr_inany bind_sa; - socklen_t sl; - pif_sockaddr(c, &bind_sa, &sl, PIF_HOST, &tgt->oaddr, tgt->oport); + pif_sockaddr(c, &bind_sa, PIF_HOST, &tgt->oaddr, tgt->oport); if (!inany_is_unspecified(&tgt->oaddr) || tgt->oport) { - if (bind(s, &bind_sa.sa, sl)) { + if (bind(s, &bind_sa.sa, socklen_inany(&bind_sa))) { char sstr[INANY_ADDRSTRLEN]; flow_dbg_perror(conn, @@ -1508,7 +1507,6 @@ static void tcp_conn_from_tap(const struct ctx *c, sa_family_t af, union flow *flow; int s = -1, mss; uint64_t hash; - socklen_t sl; if (!(flow = flow_alloc())) return; @@ -1541,7 +1539,7 @@ static void tcp_conn_from_tap(const struct ctx *c, sa_family_t af, if ((s = tcp_conn_sock(af)) < 0) goto cancel; - pif_sockaddr(c, &sa, &sl, PIF_HOST, &tgt->eaddr, tgt->eport); + pif_sockaddr(c, &sa, PIF_HOST, &tgt->eaddr, tgt->eport); /* Use bind() to check if the target address is local (EADDRINUSE or * similar) and already bound, and set the LOCAL flag in that case. @@ -1553,7 +1551,7 @@ static void tcp_conn_from_tap(const struct ctx *c, sa_family_t af, * * So, if bind() succeeds, close the socket, get a new one, and proceed. */ - if (bind(s, &sa.sa, sl)) { + if (bind(s, &sa.sa, socklen_inany(&sa))) { if (errno != EADDRNOTAVAIL && errno != EACCES) conn_flag(c, conn, LOCAL); } else { @@ -1593,7 +1591,7 @@ static void tcp_conn_from_tap(const struct ctx *c, sa_family_t af, tcp_bind_outbound(c, conn, s); - if (connect(s, &sa.sa, sl)) { + if (connect(s, &sa.sa, socklen_inany(&sa))) { if (errno != EINPROGRESS) { tcp_rst(c, conn); goto cancel; @@ -1612,7 +1610,8 @@ static void tcp_conn_from_tap(const struct ctx *c, sa_family_t af, tcp_epoll_ctl(c, conn); if (c->mode == MODE_VU) { /* To rebind to same oport after migration */ - sl = sizeof(sa); + socklen_t sl = sizeof(sa); + if (getsockname(s, &sa.sa, &sl) || inany_from_sockaddr(&tgt->oaddr, &tgt->oport, &sa) < 0) err_perror("Can't get local address for socket %i", s); @@ -3592,11 +3591,10 @@ static int tcp_flow_repair_bind(const struct ctx *c, struct tcp_tap_conn *conn) { const struct flowside *sockside = HOSTFLOW(conn); union sockaddr_inany a; - socklen_t sl; - pif_sockaddr(c, &a, &sl, PIF_HOST, &sockside->oaddr, sockside->oport); + pif_sockaddr(c, &a, PIF_HOST, &sockside->oaddr, sockside->oport); - if (bind(conn->sock, &a.sa, sizeof(a))) { + if (bind(conn->sock, &a.sa, socklen_inany(&a))) { int rc = -errno; flow_perror(conn, "Failed to bind socket for migrated flow"); return rc; diff --git a/tcp_splice.c b/tcp_splice.c index 26cb6306..174a64d9 100644 --- a/tcp_splice.c +++ b/tcp_splice.c @@ -351,7 +351,6 @@ static int tcp_splice_connect(const struct ctx *c, struct tcp_splice_conn *conn) sa_family_t af = inany_v4(&tgt->eaddr) ? AF_INET : AF_INET6; uint8_t tgtpif = conn->f.pif[TGTSIDE]; union sockaddr_inany sa; - socklen_t sl; int one = 1; if (tgtpif == PIF_HOST) @@ -379,9 +378,9 @@ static int tcp_splice_connect(const struct ctx *c, struct tcp_splice_conn *conn) conn->s[1]); } - pif_sockaddr(c, &sa, &sl, tgtpif, &tgt->eaddr, tgt->eport); + pif_sockaddr(c, &sa, tgtpif, &tgt->eaddr, tgt->eport); - if (connect(conn->s[1], &sa.sa, sl)) { + if (connect(conn->s[1], &sa.sa, socklen_inany(&sa))) { if (errno != EINPROGRESS) { flow_trace(conn, "Couldn't connect socket for splice: %s", strerror_(errno)); diff --git a/udp.c b/udp.c index 86585b7e..8f96495d 100644 --- a/udp.c +++ b/udp.c @@ -773,7 +773,6 @@ static void udp_sock_to_sock(const struct ctx *c, int from_s, int n, const struct udp_flow *uflow = udp_at_sidx(tosidx); uint8_t topif = pif_at_sidx(tosidx); int to_s = uflow->s[tosidx.sidei]; - socklen_t sl; int i; if ((n = udp_sock_recv(c, from_s, udp_mh_recv, n)) <= 0) @@ -784,7 +783,7 @@ static void udp_sock_to_sock(const struct ctx *c, int from_s, int n, = udp_mh_recv[i].msg_len; } - pif_sockaddr(c, &udp_splice_to, &sl, topif, + pif_sockaddr(c, &udp_splice_to, topif, &toside->eaddr, toside->eport); sendmmsg(to_s, udp_mh_splice, n, MSG_NOSIGNAL); @@ -986,7 +985,6 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, flow_sidx_t tosidx; in_port_t src, dst; uint8_t topif; - socklen_t sl; ASSERT(!c->no_udp); @@ -1028,7 +1026,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, s = uflow->s[tosidx.sidei]; ASSERT(s >= 0); - pif_sockaddr(c, &to_sa, &sl, topif, &toside->eaddr, toside->eport); + pif_sockaddr(c, &to_sa, topif, &toside->eaddr, toside->eport); for (i = 0, j = 0; i < (int)p->count - idx && j < UIO_MAXIOV; i++) { const struct udphdr *uh_send; @@ -1041,7 +1039,7 @@ int udp_tap_handler(const struct ctx *c, uint8_t pif, return p->count - idx; mm[i].msg_hdr.msg_name = &to_sa; - mm[i].msg_hdr.msg_namelen = sl; + mm[i].msg_hdr.msg_namelen = socklen_inany(&to_sa); if (data.cnt) { int cnt; diff --git a/util.c b/util.c index c492f904..976fcabe 100644 --- a/util.c +++ b/util.c @@ -44,7 +44,6 @@ * @c: Execution context * @type: epoll type * @sa: Socket address to bind to - * @sl: Length of @sa * @ifname: Interface for binding, NULL for any * @v6only: Set IPV6_V6ONLY socket option * @data: epoll reference portion for protocol handlers @@ -52,10 +51,10 @@ * Return: newly created socket, negative error code on failure */ int sock_l4_sa(const struct ctx *c, enum epoll_type type, - const void *sa, socklen_t sl, - const char *ifname, bool v6only, uint32_t data) + const union sockaddr_inany *sa, const char *ifname, + bool v6only, uint32_t data) { - sa_family_t af = ((const struct sockaddr *)sa)->sa_family; + sa_family_t af = sa->sa_family; union epoll_ref ref = { .type = type, .data = data }; bool freebind = false; struct epoll_event ev; @@ -152,7 +151,7 @@ int sock_l4_sa(const struct ctx *c, enum epoll_type type, } } - if (bind(fd, sa, sl) < 0) { + if (bind(fd, &sa->sa, socklen_inany(sa)) < 0) { /* We'll fail to bind to low ports if we don't have enough * capabilities, and we'll fail to bind on already bound ports, * this is fine. This might also fail for ICMP because of a diff --git a/util.h b/util.h index 22eaac56..e1a1ebc9 100644 --- a/util.h +++ b/util.h @@ -201,10 +201,11 @@ int do_clone(int (*fn)(void *), char *stack_area, size_t stack_size, int flags, #include "packet.h" struct ctx; +union sockaddr_inany; int sock_l4_sa(const struct ctx *c, enum epoll_type type, - const void *sa, socklen_t sl, - const char *ifname, bool v6only, uint32_t data); + const union sockaddr_inany *sa, const char *ifname, + bool v6only, uint32_t data); int sock_unix(char *sock_path); void sock_probe_mem(struct ctx *c); long timespec_diff_ms(const struct timespec *a, const struct timespec *b); -- 2.51.0

2 2

[PATCH] tcp: Properly remove sockets from epoll loop when connection is closed
by David Gibson 13 Nov '25

13 Nov '25

Most of the handling for closing a TCP connectin is in conn_event_do() when it receives a 'CLOSED' event. We specifically check for this case and, correctly, remove the connection from the flow hash table. However, we also bypass the call tp tcp_epoll_ctl() which is not correct. By skipping tcp_epoll_ctl() we skip it's specific handling of the CLOSED event, which includes removing the TCP socket from epoll. If we somehow get an event on such a stale socket, we'll get a stale flow reference. That flow slot might have been re-used, leading to to a crash in conn_at_sidx(). Fixes: b86afe3559c0 ("tcp: Don't defer hash table removal") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tcp.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/tcp.c b/tcp.c index e91c0cf5..3202d338 100644 --- a/tcp.c +++ b/tcp.c @@ -694,12 +694,13 @@ void conn_event_do(const struct ctx *c, struct tcp_tap_conn *conn, flow_dbg(conn, "%s", num == -1 ? "CLOSED" : tcp_event_str[num]); - if (event == CLOSED) - flow_hash_remove(c, TAP_SIDX(conn)); - else if ((event == TAP_FIN_RCVD) && !(conn->events & SOCK_FIN_RCVD)) + if ((event == TAP_FIN_RCVD) && !(conn->events & SOCK_FIN_RCVD)) { conn_flag(c, conn, ACTIVE_CLOSE); - else + } else { + if (event == CLOSED) + flow_hash_remove(c, TAP_SIDX(conn)); tcp_epoll_ctl(c, conn); + } if (CONN_HAS(conn, SOCK_FIN_SENT | TAP_FIN_ACKED)) tcp_timer_ctl(conn); -- 2.51.1

2 1

[PATCH v7 0/5] Retry SYNs for inbound connections
by Yumei Huang 10 Nov '25

10 Nov '25

When a client connects, SYN would be sent to guest only once. If the guest is not connected or ready at that time, the connection will be reset in 10s. These patches introduce the SYN retry mechanism using the similar backoff timeout as linux kernel. Also update the data retransmission timeout using the backoff timeout. v7: - Update read_file() and read_file_integer() - Rename tcp_syn_params_init() to tcp_get_rto_params() - Modify the implementation of the timeout assignment - Add a patch to clamp the retry timeout Yumei Huang (5): tcp: Rename "retrans" to "retries" util: Introduce read_file() and read_file_integer() function tcp: Resend SYN for inbound connections tcp: Update data retransmission timeout tcp: Clamp the retry timeout tcp.c | 86 ++++++++++++++++++++++++++++++++++++++++++------------ tcp.h | 6 ++++ tcp_conn.h | 12 ++++---- util.c | 86 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ util.h | 2 ++ 5 files changed, 168 insertions(+), 24 deletions(-) -- 2.49.0

3 33

Re: [PATCH v2] contrib/selinux: use regex instead of SELinux template
by Stefano Brivio 06 Nov '25

06 Nov '25

On Wed, 05 Nov 2025 03:28:22 -0700 Max Chernoff <git(a)maxchernoff.ca> wrote: > Hi Stefano, > > On Tue, 2025-11-04 at 22:13 +0100, Stefano Brivio wrote: > > Max, thanks for testing and reviewing, I took the liberty to translate > > your comments into Tested-by: and Reviewed-by: tags as they clearly > > seemed to indicate that. > > Ah, thanks for that! I'm still fairly new to the patch-on-a-mailing-list > workflow, so is there something that I should have done differently? We use pretty much the same tags as the Linux kernel does: https://docs.kernel.org/process/submitting-patches.html#using-reported-by-t… (except we only use Link:, not Closes:) which are nice because they're machine-readable, so one could use, say, for instance, a script like: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/scr… to Cc: you automatically on a patch if you often reviewed or tested the code or file affected by it. So, here, you could have simply replied with: Reviewed-by: Max Chernoff <git(a)maxchernoff.ca> Tested-by: Max Chernoff <git(a)maxchernoff.ca> to unequivocally state what you did with that submission. Now, passt is small enough that we don't really have much of a use for that at the moment, but it still sounds like a good idea in general, also to future-proof things. It's also small enough that I can add / fix tags as I merge patches without much fuss. And yes, this should also be added to the new CONTRIBUTING.md file, I have a growing list of small items to add and I'll do that in a batch at some point. :) -- Stefano

2 1

Re: [PATCH] contrib/selinux: use regex instead of non-standard bash macro
by Stefano Brivio 05 Nov '25

05 Nov '25

Hi Danish, On Mon, 27 Oct 2025 14:19:14 +0530 Danish Prakash <contact(a)danishpraka.sh> wrote: > On 10/16/25 4:26 PM, Max Chernoff wrote: > > Hi Stefano, > > > > On Thu, 2025-10-16 at 10:21 +0200, Stefano Brivio wrote: > >> On Thu, 16 Oct 2025 13:10:41 +0530 > >> Danish Prakash <contact(a)danishpraka.sh> wrote: > >>> It might be possible to avoid using non-standard bash macro (%USERID), > > > > It's not a Bash macro, it's a SELinux template. This doesn't seem to be > > documented anywhere (which isn't terribly surprising with SELinux), but > > it's defined in this file: > > > > https://github.com/SELinuxProject/selinux/blob/ceb5b221/libsemanage/src/gen… > > Thanks Max, I wasn't aware of it being an SELinux template. > > > > >> I wonder if > >> Max remembers any reason why we couldn't do this in the first place. > > > > The Fedora SELinux policy always uses %{USERID}, and so I copied it from > > there: > > > > $ grep -RnF '%{USERID}' policy/ > > policy/modules/contrib/dbus.fc:29:/run/user/%{USERID}/bus -s gen_context(system_u:object_r:session_dbusd_tmp_t,s0) > > policy/modules/contrib/dbus.fc:30:/run/user/%{USERID}/dbus(/.*)? gen_context(system_u:object_r:session_dbusd_tmp_t,s0) > > policy/modules/contrib/dbus.fc:31:/run/user/%{USERID}/dbus-1(/.*)? gen_context(system_u:object_r:session_dbusd_tmp_t,s0) > > policy/modules/contrib/gnome.fc:25:/run/user/%{USERID}/\.orc(/.*)? gen_context(system_u:object_r:gstreamer_home_t,s0) > > policy/modules/contrib/gnome.fc:26:/run/user/%{USERID}/dconf(/.*)? gen_context(system_u:object_r:config_home_t,s0) > > policy/modules/contrib/gnome.fc:27:/run/user/%{USERID}/keyring.* gen_context(system_u:object_r:gkeyringd_tmp_t,s0) > > policy/modules/kernel/filesystem.fc:17:/run/user/%{USERID}/gvfs -d gen_context(system_u:object_r:fusefs_t,s0) > > policy/modules/kernel/filesystem.fc:18:/run/user/%{USERID}/gvfs/.* <<none>> > > policy/modules/system/userdomain.fc:38:/run/user/%{USERID} -d gen_context(system_u:object_r:user_tmp_t,s0) > > policy/modules/system/userdomain.fc:39:/run/user/%{USERID}/.+ <<none>> > > > > $ grep -RnF '[0-9]+' policy/ | grep -v /dev/ > > policy/modules/contrib/rpm.fc:52:/usr/bin/rhn_check-[0-9]+\.[0-9]+ -- gen_context(system_u:object_r:rpm_exec_t,s0) > > policy/modules/contrib/soundserver.fc:12:/run/yiff-[0-9]+\.pid -- gen_context(system_u:object_r:soundd_var_run_t,s0) > > policy/modules/kernel/devices.if:6958:## Allow read the hfi1_[0-9]+ devices > > > >>> diff --git a/contrib/fedora/passt.spec b/contrib/fedora/passt.spec > >>> index 663289f53d97..d1bcf4a74338 100644 > >>> --- a/contrib/fedora/passt.spec > >>> +++ b/contrib/fedora/passt.spec > >>> [...] > >> > >> At a glance, this looks like a better solution regardless of the > >> reported issue. It sounds too good to be true, though > > > > I agree that it looks like a good solution, which makes me wonder why > > the base SELinux policies don't do it that way. The containers SELinux > > policy appears to do things this way > > > > $ grep -RnF '[0-9]+' > > container_selinux.8:166: /run/user/[0-9]+/gvfs > > $ grep -RnF '%{USERID}'; echo $? > > 1 > > > > so it's probably (?) okay though. > > That's helpful, I guess we can go ahead with this. Stefano, Paul? Sure. But back to my question about the original problem... what was the original problem? :) Could it be something similar to: https://bugzilla.redhat.com/show_bug.cgi?id=2401764 ? In general, there are a bunch of current SELinux issues reported on Fedora/RHEL (and I assume they would be exactly the same on openSUSE/SLES): https://bugzilla.redhat.com/buglist.cgi?bug_status=__open__&columnlist=shor… and I'm trying to find out if this change might fix some of them. Most of those are stuff I didn't investigate yet. -- Stefano

3 12

[RFC PATCH 0/3] Fill exceeding size of vhost-user buffers explicitly
by Stefano Brivio 05 Nov '25

05 Nov '25

While looking for a way to ensure inbound frames are padded to 60 bytes in vhost-user mode, I spotted the issue described in 1/3, which looks a bit too obvious to be true, so I'm sending this as RFC. Am I missing something there, or do we actually need to fix that? Stefano Brivio (3): vu_common: Stick to size of input buffer in vu_send_single() iov: Fix coding style of basic (non-IOV_TAIL) parts iov, vu_common: Make iov_from_buf() fill destination iov entirely iov.c | 116 +++++++++++++++++++++++++++------------------------- iov.h | 4 +- vu_common.c | 22 +++++----- 3 files changed, 74 insertions(+), 68 deletions(-) -- 2.43.0

3 10

[PATCH 0/8] RFC: Cleanups to auto port scanning
by David Gibson 03 Nov '25

03 Nov '25

One of the trickiest parts of implementing the improved forwarding table is integrating it properly with automatic forwarding (-t auto etc.). Here are some preliminary cleanups to the automatic port scanning that will make the job a bit easier. David Gibson (8): icmp: Remove vestiges of ICMP timer tcp, udp, fwd: Run all port scanning from a single timer fwd: Consolidate scans (not rebinds) in fwd.c fwd: Move port exclusion handling from procfs_scan_listen() to callers fwd: Share port scanning logic between init and timer cases fwd: Check forwarding mode in fwd_scan_ports_*() rather than caller fwd: Update all port maps before applying exclusions tcp, udp: Don't exclude ports in {tcp,udp}_port_rebind() fwd.c | 107 ++++++++++++++++++++++++++++++++++++++------------------ fwd.h | 7 ++-- icmp.h | 2 -- passt.c | 8 ++--- tcp.c | 34 +++++++++--------- tcp.h | 3 +- udp.c | 31 ++++------------ udp.h | 4 +-- util.c | 23 ++++++++++++ util.h | 1 + 10 files changed, 129 insertions(+), 91 deletions(-) -- 2.51.0

2 12

[PATCH v2 0/8] Cleanups to auto port scanning
by David Gibson 01 Nov '25

01 Nov '25

One of the trickiest parts of implementing the improved forwarding table is integrating it properly with automatic forwarding (-t auto etc.). Here are some preliminary cleanups to the automatic port scanning that will make the job a bit easier. v2: * Rename bitmap_andc() to bitmap_and_not() (4/8) * Fixed comment formatting error (4/8) * Updated commit message based on further information from Stefano (7,8/8) * All other patches unchanged, except for trivial rebase fixes David Gibson (8): icmp: Remove vestiges of ICMP timer tcp, udp, fwd: Run all port scanning from a single timer fwd: Consolidate scans (not rebinds) in fwd.c fwd: Move port exclusion handling from procfs_scan_listen() to callers fwd: Share port scanning logic between init and timer cases fwd: Check forwarding mode in fwd_scan_ports_*() rather than caller fwd: Update all port maps before applying exclusions tcp, udp: Don't exclude ports in {tcp,udp}_port_rebind() fwd.c | 107 ++++++++++++++++++++++++++++++++++++++------------------ fwd.h | 7 ++-- icmp.h | 2 -- passt.c | 8 ++--- tcp.c | 34 +++++++++--------- tcp.h | 3 +- udp.c | 31 ++++------------ udp.h | 4 +-- util.c | 24 +++++++++++++ util.h | 2 ++ 10 files changed, 131 insertions(+), 91 deletions(-) -- 2.51.0

2 9