- dev - passt

[PATCH] selinux: Allow pasta to create and use its control socket when started by Podman
by Stefano Brivio 19 May '26

19 May '26

If Podman starts us, we need to be able to create and use a UNIX domain socket file under ifconfig_var_run_t or container_var_run_t: add the related permissions. The failure reported by Jan would have been fixed by a simple: allow pasta_t ifconfig_var_run_t:sock_file create; but we'll need more than that for actual operation with pesto(1), and to cover all possible cases. Reported-by: Jan Rodák <jrodak(a)redhat.com> Link: https://github.com/containers/podman/pull/28478 Fixes: 533577008942 ("selinux: Add file context and type enforcement for pesto") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/selinux/pasta.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index fb51416..ff74dd7 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -253,6 +253,8 @@ allow pasta_t container_var_run_t:dir { add_name open rmdir write }; allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; allow pasta_t container_var_run_t:file { create open write }; allow pasta_t ifconfig_var_run_t:file { create open write }; +allow pasta_t container_var_run_t:sock_file { getattr create open read write }; +allow pasta_t ifconfig_var_run_t:sock_file { getattr create open read write }; allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; # Allow pasta to bind to any port -- 2.43.0

1 0

[PATCH v2 2/3] tap: Report accept() errors
by David Gibson 18 May '26

18 May '26

Currently, if accept4() fails in tap_listen_handler(), we carry on as if it succeeded. Something will probably fail shortly down the line, but that's needlessly confusing. Report an error instead. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tap.c b/tap.c index e7cac9df..660f1cb6 100644 --- a/tap.c +++ b/tap.c @@ -1491,6 +1491,10 @@ void tap_listen_handler(struct ctx *c, uint32_t events) } c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, SOCK_CLOEXEC); + if (c->fd_tap < 0) { + warn_perror("Error accepting tap client"); + return; + } if (!getsockopt(c->fd_tap, SOL_SOCKET, SO_PEERCRED, &ucred, &len)) info("accepted connection from PID %i", ucred.pid); -- 2.54.0

1 0

[PATCH 3/3] conf, repair, tap: More caution about blocking flag on Unix sockets
by David Gibson 18 May '26

18 May '26

Most of our operation is asynchronous, based on non-blocking fds handled in our epoll loop. However, our several Unix sockets (tap client, repair helper, control client) are all blocking fds after accept(). That's correct for the repair helper, and (for now) correct for the control client. However, the reasons for that might not be obvious, so add some extra comments giving the rationale. I don't believe it's correct for the tap client; having this socket be blocking means we could potentially block the main loop if we ever got a a spurious EPOLL{IN,OUT} event on the tap socket. Switch the tap socket to non-blocking for better robustness, and consistency with nearly every other fd we track. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- conf.c | 6 ++++++ repair.c | 4 ++++ tap.c | 3 ++- 3 files changed, 12 insertions(+), 1 deletion(-) diff --git a/conf.c b/conf.c index dec43fca..dc85f0f8 100644 --- a/conf.c +++ b/conf.c @@ -2082,6 +2082,12 @@ static void conf_accept(struct ctx *c) int fd, rc; retry: + /* Currently we perform the configuration transaction more-or-less + * synchronously, so we want the accepted socket to be blocking. + * + * FIXME: We should make the configuration update asynchronous, like + * most of our operation, so a misbehaving configuration client can't + * block the main forwarding loop */ fd = accept4(c->fd_control_listen, NULL, NULL, SOCK_CLOEXEC); if (fd < 0) { if (errno != EAGAIN) diff --git a/repair.c b/repair.c index 42c4ae97..8a2d119d 100644 --- a/repair.c +++ b/repair.c @@ -99,6 +99,10 @@ int repair_listen_handler(struct ctx *c, uint32_t events) return EEXIST; } + /* We want accepted socket to be blocking; we use it during migration + * which is a synchronous interruption to our normal non-blocking + * behaviour. + */ if ((c->fd_repair = accept4(c->fd_repair_listen, NULL, NULL, SOCK_CLOEXEC)) < 0) { if ((rc = errno) != EAGAIN) diff --git a/tap.c b/tap.c index fda2da9b..3b8a3f3d 100644 --- a/tap.c +++ b/tap.c @@ -1490,7 +1490,8 @@ void tap_listen_handler(struct ctx *c, uint32_t events) return; } - c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, SOCK_CLOEXEC); + c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, + SOCK_NONBLOCK | SOCK_CLOEXEC); if (c->fd_tap < 0) { if (errno != EAGAIN) warn_perror("Error accepting tap client"); -- 2.54.0

2 2

[PATCH] util: Fix changes to assert_with_msg()
by David Gibson 18 May '26

18 May '26

A last minute fixup to commit e51494552b78 was misapplied. Instead of improving the implementation of assert_with_msg() for the case where NDEBUG is defined, it effectively eliminated assert_with_msg() in the normal case where NDEBUG is _not_ defined. As well as removing assert()s which protect us in case of certian types of bug, this introduces some cppcheck and clang-tidy regressions. Fixes: e51494552b78 ("Fix build with -DNDEBUG") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util.h b/util.h index a9dcc04c..144dc1e6 100644 --- a/util.h +++ b/util.h @@ -51,7 +51,7 @@ void abort_with_msg(const char *fmt, ...) */ #ifndef NDEBUG #define assert_with_msg(expr, ...) \ - (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) + ((expr) ? (void)0 : abort_with_msg(__VA_ARGS__)) /* The standard library assert() hits our seccomp filter and dies before it can * actually print a message. So, replace it with our own version. */ @@ -61,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) __func__, __FILE__, __LINE__, STRINGIFY(expr)) #else #define assert_with_msg(expr, ...) \ - ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) #endif #ifdef P_tmpdir -- 2.54.0

2 2

[PATCH v2] util: Fix changes to assert_with_msg()
by David Gibson 17 May '26

17 May '26

A last minute fixup to commit e51494552b78 was misapplied. Instead of improving the implementation of assert_with_msg() for the case where NDEBUG is defined, it effectively eliminated assert_with_msg() in the normal case where NDEBUG is _not_ defined. As well as removing assert()s which protect us in case of certian types of bug, this introduces some cppcheck and clang-tidy regressions. Fixes: e51494552b78 ("Fix build with -DNDEBUG") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- util.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/util.h b/util.h index a9dcc04c..144dc1e6 100644 --- a/util.h +++ b/util.h @@ -51,7 +51,7 @@ void abort_with_msg(const char *fmt, ...) */ #ifndef NDEBUG #define assert_with_msg(expr, ...) \ - (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) + ((expr) ? (void)0 : abort_with_msg(__VA_ARGS__)) /* The standard library assert() hits our seccomp filter and dies before it can * actually print a message. So, replace it with our own version. */ @@ -61,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) __func__, __FILE__, __LINE__, STRINGIFY(expr)) #else #define assert_with_msg(expr, ...) \ - ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) #endif #ifdef P_tmpdir -- 2.54.0

1 1

[PATCH] lib/term: Quote tr character ranges to prevent glob expansion
by Laurent Vivier 16 May '26

16 May '26

Single-letter files in the working directory cause glob expansion of unquoted tr character ranges like [A-Z] and [a-z]. When the shell expands these against matching filenames, tr receives wrong arguments and pane_or_context_run() hangs without errors. Apply the same fix as in a36031a4d807 ("seccomp.sh: Quote tr character ranges to prevent glob expansion"): quote all tr ranges in test/lib/term. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- test/lib/term | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/test/lib/term b/test/lib/term index 89e4fdbe591d..2d2d2182de14 100755 --- a/test/lib/term +++ b/test/lib/term @@ -198,7 +198,7 @@ pane_run() { # pane_wait() - Wait for command to be done in given pane name # $1: Pane name pane_wait() { - __lc="$(echo "${1}" | tr [A-Z] [a-z])" + __lc="$(echo "${1}" | tr '[A-Z]' '[a-z]')" sleep 0.01 || sleep 1 __done=0 @@ -213,7 +213,7 @@ pane_wait() { # pane_parse() - Print last line, @EMPTY@ if command had no output # $1: Pane name pane_parse() { - __pane_lc="$(echo "${1}" | tr [A-Z] [a-z])" + __pane_lc="$(echo "${1}" | tr '[A-Z]' '[a-z]')" __buf="$(tail -n2 ${LOGDIR}/pane_${__pane_lc}.log | head -n1 | sed 's/^[^\r]*\r$[^\r]$/\1/;s/[]][^]*[\]//g' | tr -d '\r\n')" @@ -267,7 +267,7 @@ pane_or_context_run() { # Redirect stdin to stop ssh from eating the test instructions file we have on stdin context_run "${__name}" "$@" >/dev/null 2>&1 < /dev/null else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" pane_status "${__uc}" fi @@ -283,7 +283,7 @@ pane_or_context_run_bg() { # Redirect stdin to stop ssh from eating the test instructions file we have on stdin context_run_bg "${__name}" "$@" >/dev/null 2>&1 < /dev/null else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" fi } @@ -303,7 +303,7 @@ pane_or_context_output() { echo "${__output}" fi else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_run "${__uc}" "$@" pane_wait "${__uc}" pane_parse "${__uc}" @@ -318,7 +318,7 @@ pane_or_context_wait() { if context_exists "${__name}"; then context_wait "${__name}" else - __uc="$(echo "${__name}" | tr [a-z] [A-Z])" + __uc="$(echo "${__name}" | tr '[a-z]' '[A-Z]')" pane_wait "${__uc}" fi } -- 2.54.0

3 2

[PATCH 0/2] Fix regression when one IP version is disabled
by David Gibson 16 May '26

16 May '26

Fix for a simple but nasty regression caused by the recent forwarding table work. Plus a tiny feature in adjacent code. Link: https://bugs.passt.top/show_bug.cgi?id=205 David Gibson (2): fwd_rule: Don't attempt dual stack listen()s if only one IP family fwd_rule: Allow parsing * as a forwarding address fwd_rule.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) -- 2.54.0

2 3

Re: [PATCH 2/3] Fix build with -DNDEBUG
by David Gibson 16 May '26

16 May '26

On Fri, May 15, 2026 at 01:05:50PM +0200, Jan Palus wrote: > On 15.05.2026 14:13, David Gibson wrote: > > Since bc872d91765d, our assert() statements are omitted if we compile with > > -DNDEBUG, like the standard library assert(3). Unfortunately a trivial but > > embarrassing mistake in that patch means that instead of never aborting in > > this case, assert_with_msg() *always* aborts, breaking pretty much > > everything. > > > > There's also a missing #include that breaks the build with -DNDEBUG on at > > least some library versions. > > > > Reported-by: Jan Palus <jpalus(a)fastmail.com> > > Fixes: bc872d91765d ("treewide: Spell ASSERT() as assert()") > > Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> > > --- > > util.h | 3 ++- > > 1 file changed, 2 insertions(+), 1 deletion(-) > > > > diff --git a/util.h b/util.h > > index 70aadeba..11f71d45 100644 > > --- a/util.h > > +++ b/util.h > > @@ -6,6 +6,7 @@ > > #ifndef UTIL_H > > #define UTIL_H > > > > +#include <assert.h> > > #include <stdlib.h> > > #include <stdarg.h> > > #include <stdbool.h> > > @@ -60,7 +61,7 @@ void abort_with_msg(const char *fmt, ...) > > __func__, __FILE__, __LINE__, STRINGIFY(expr)) > > #else > > #define assert_with_msg(expr, ...) \ > > - ((void)(expr), 0 ? (void)0 : abort_with_msg(__VA_ARGS__)) > > + ((void)(expr), 1 ? (void)0 : abort_with_msg(__VA_ARGS__)) > > There is a slight semantic difference between assert() and > assert_with_msg() when building with -DNDEBUG -- `expr` is still being > evaluated in abort_with_msg() although likely optimized out in most > builds. Right, I'm expecting the compiler to optimise this away. That won't be the case if the expression has side effects, but side effects in an assert() expression is already a bug, precisely because of the possibility NDEBUG. > I'm assuming you'd prefer to avoid cppcheck suppressions. cppcheck suppressions would be acceptable if we could put them inside the macro. But these are unused variable warnings, which show up at the site of variable declaration not (obviously) at the place the variable... isn't used. Putting suppressions on variables because they might become unused depending on a macro definition certainly isn't acceptable. Both for aesthetics, and because it means if we removed the assert we'd no longer get a warning that the variable now really isn't used. > How > about moving `expr` into branch which is never evaluated then? Would it > keep cppcheck happy? > > + (1 ? (void)0 : ((void)(expr), abort_with_msg(__VA_ARGS__))) That does work. Not sure if it's worth the bother of a respin. Stefano, any opinion? -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

2 2

[PATCH 3/3] test: Add test for builds with -DNDEBUG
by David Gibson 15 May '26

15 May '26

Since bc872d91765d we omit assert()s if the NDEBUG preprocessor symbol is defined, as is the case with the standard library assert(3). However, none of our tests verify that we can actually build that way. Add an extra test to test/build/build.py tto verify this. Fixes: bc872d91765d ("treewide: Spell ASSERT() as assert()") Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- test/build/build.py | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/test/build/build.py b/test/build/build.py index eeee5acc..59de014a 100755 --- a/test/build/build.py +++ b/test/build/build.py @@ -77,6 +77,20 @@ for bin in BINARIES: exeter.register('make_all', test_make, 'all', BINARIES) +(a)exeter.test +def test_ndebug() -> None: + """Test build with -NDEBUG + + Tests that we can build all binaries with -DNDEBUG (warnings are + expected, though). Doesn't test that they actually work. + """ + + with clone_sources(): + sh('make all CPPFLAGS="-DNDEBUG" CFLAGS="-w"') + for b in BINARIES: + assert Path(b).exists(), f"{b} wasn't made" + + @exeter.test def test_install_uninstall() -> None: """Test `make install` and `make uninstall` -- 2.54.0

1 0

[PATCH] ndp: Suppress Coverity false positive for random()
by Laurent Vivier 14 May '26

14 May '26

Coverity flags the random() call in ndp_timer() with the dont_call checker, warning that it should not be used for security-related applications. This is a false positive: random() is used here to jitter the interval between unsolicited Router Advertisements as required by RFC 4861, to prevent synchronisation between routers on a link. No cryptographic strength is needed. Suppress the warning with an inline Coverity annotation. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> --- ndp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/ndp.c b/ndp.c index 1f2bcb0cc7ea..614932ac5829 100644 --- a/ndp.c +++ b/ndp.c @@ -441,6 +441,7 @@ void ndp_timer(const struct ctx *c, const struct timespec *now) * again, it's close enough for our purposes. */ interval = min_rtr_adv_interval + + /* coverity[dont_call:FALSE] */ random() % (max_rtr_adv_interval - min_rtr_adv_interval); if (!next_ra) -- 2.54.0

3 2