- dev - passt

[PATCH v11 1/3] udp_vu: Allow virtqueue elements with multiple iovec entries
by Laurent Vivier 20 May '26

20 May '26

The previous code assumed a 1:1 mapping between virtqueue elements and iovec entries (enforced by an assert). Drop that assumption to allow elements that span multiple iovecs: track elem_used separately by walking the element list against the iov count returned after padding. This also fixes vu_queue_rewind() and vu_flush() to use the element count rather than the iov count. Use iov_tail_clone() in udp_vu_sock_recv() to handle header offset, replacing the manual base/len adjustment and restore pattern. Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> Reviewed-by: David Gibson <david(a)gibson.dropbear.id.au> Reviewed-by: Jon Maloy <jmaloy(a)redhat.com> --- udp_vu.c | 31 ++++++++++++++++--------------- 1 file changed, 16 insertions(+), 15 deletions(-) diff --git a/udp_vu.c b/udp_vu.c index dfff7bb1cd53..74bf79d57969 100644 --- a/udp_vu.c +++ b/udp_vu.c @@ -66,30 +66,25 @@ static size_t udp_vu_hdrlen(bool v6) */ static ssize_t udp_vu_sock_recv(struct iovec *iov, size_t *cnt, int s, bool v6) { + struct iovec msg_iov[VIRTQUEUE_MAX_SIZE]; struct msghdr msg = { 0 }; + struct iov_tail payload; size_t hdrlen, iov_used; ssize_t dlen; /* compute L2 header length */ hdrlen = udp_vu_hdrlen(v6); - /* reserve space for the headers */ - assert(iov[0].iov_len >= MAX(hdrlen, ETH_ZLEN + VNET_HLEN)); - iov[0].iov_base = (char *)iov[0].iov_base + hdrlen; - iov[0].iov_len -= hdrlen; + payload = IOV_TAIL(iov, *cnt, hdrlen); - /* read data from the socket */ - msg.msg_iov = iov; - msg.msg_iovlen = *cnt; + msg.msg_iov = msg_iov; + msg.msg_iovlen = iov_tail_clone(msg.msg_iov, payload.cnt, &payload); + /* read data from the socket */ dlen = recvmsg(s, &msg, 0); if (dlen < 0) return -1; - /* restore the pointer to the headers address */ - iov[0].iov_base = (char *)iov[0].iov_base - hdrlen; - iov[0].iov_len += hdrlen; - iov_used = iov_skip_bytes(iov, *cnt, MAX(dlen + hdrlen, VNET_HLEN + ETH_ZLEN), NULL); @@ -202,7 +197,7 @@ void udp_vu_sock_to_tap(const struct ctx *c, int s, int n, flow_sidx_t tosidx) } for (i = 0; i < n; i++) { - unsigned elem_cnt, elem_used; + unsigned elem_cnt, elem_used, j, k; size_t iov_cnt; ssize_t dlen; @@ -212,15 +207,21 @@ void udp_vu_sock_to_tap(const struct ctx *c, int s, int n, flow_sidx_t tosidx) if (elem_cnt == 0) break; - assert((size_t)elem_cnt == iov_cnt); /* one iovec per element */ - dlen = udp_vu_sock_recv(iov_vu, &iov_cnt, s, v6); if (dlen < 0) { vu_queue_rewind(vq, elem_cnt); break; } - elem_used = iov_cnt; /* one iovec per element */ + elem_used = 0; + for (j = 0, k = 0; k < iov_cnt && j < elem_cnt; j++) { + size_t iov_still_needed = iov_cnt - k; + + if (elem[j].in_num > iov_still_needed) + elem[j].in_num = iov_still_needed; + k += elem[j].in_num; + elem_used++; + } /* release unused buffers */ vu_queue_rewind(vq, elem_cnt - elem_used); -- 2.54.0

1 0

[PATCH RFT] fwd: Only do inbound IPv6 NAT to map_host_loopback / map_guest_addr with matching scope
by Stefano Brivio 20 May '26

20 May '26

I'm sharing this mostly for debugging / investigation of: https://github.com/containers/container-libs/pull/755#issuecomment-43904201… even though the change is probably correct and needed regardless of that. If we have map_guest_addr or map_host_loopback addresses set for IPv6, before using them for inbound NAT from the host, make sure they match the scope of the original packet, otherwise we might unexpectedly turn global unicast addresses into link-local ones for packets coming from the host itself. Link: https://github.com/containers/container-libs/pull/755#issuecomment-43904201… Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- fwd.c | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/fwd.c b/fwd.c index 0697435..d224c0a 100644 --- a/fwd.c +++ b/fwd.c @@ -974,6 +974,20 @@ uint8_t fwd_nat_from_splice(const struct fwd_rule *rule, uint8_t proto, return PIF_HOST; } +/** + * fwd_scope6_match() - Check if the IPv6 scope of two addresses match + * @a: First address + * @b: Second address + * + * Return: true for two IPv6 link-local or both not link-local, false otherwise + * + * NOTE: This currently ignores any other difference in scope + */ +bool fwd_scope6_match(const struct in6_addr *a, const struct in6_addr *b) +{ + return IN6_IS_ADDR_LINKLOCAL(a) == IN6_IS_ADDR_LINKLOCAL(b); +} + /** * nat_inbound() - Apply address translation for inbound (HOST to TAP) * @c: Execution context @@ -993,13 +1007,15 @@ bool nat_inbound(const struct ctx *c, const union inany_addr *addr, /* Specifically 127.0.0.1, not 127.0.0.0/8 */ *translated = inany_from_v4(c->ip4.map_host_loopback); } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_host_loopback) && - inany_equals6(addr, &in6addr_loopback)) { + inany_equals6(addr, &in6addr_loopback) && + fwd_scope6_match(&addr->a6, &c->ip6.map_host_loopback)) { translated->a6 = c->ip6.map_host_loopback; } else if (!IN4_IS_ADDR_UNSPECIFIED(&c->ip4.map_guest_addr) && inany_equals4(addr, &c->ip4.addr)) { *translated = inany_from_v4(c->ip4.map_guest_addr); } else if (!IN6_IS_ADDR_UNSPECIFIED(&c->ip6.map_guest_addr) && - inany_equals6(addr, &c->ip6.addr)) { + inany_equals6(addr, &c->ip6.addr) && + fwd_scope6_match(&addr->a6, &c->ip6.map_guest_addr)) { translated->a6 = c->ip6.map_guest_addr; } else if (fwd_guest_accessible(c, addr)) { *translated = *addr; -- 2.43.0

2 7

[PATCH HACK] fwd, fwd_rule: Implement configurable destination address mapping
by Stefano Brivio 20 May '26

20 May '26

This isn't complete, it's rather a quick hack to enable early integration testing. Add a 'daddr' field to forwarding rules, and some rudimentary parsing. Format (for either command line or pesto): -t 2222:192.0.2.1/2222 This should work along with all the other bits, that is, say: -t 192.0.2.1%eth0/2222-2225:192.0.2.2/22-25 Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- fwd.c | 4 +++- fwd_rule.c | 46 +++++++++++++++++++++++++++++++++++----------- fwd_rule.h | 2 ++ 3 files changed, 40 insertions(+), 12 deletions(-) diff --git a/fwd.c b/fwd.c index d224c0a..75db350 100644 --- a/fwd.c +++ b/fwd.c @@ -1095,7 +1095,9 @@ uint8_t fwd_nat_from_host(const struct ctx *c, } tgt->oport = ini->eport; - if (inany_v4(&tgt->oaddr)) { + if (!inany_is_unspecified(&rule->daddr)) { + tgt->eaddr = rule->daddr; + } else if (inany_v4(&tgt->oaddr)) { tgt->eaddr = inany_from_v4(c->ip4.addr_seen); } else { if (inany_is_linklocal6(&tgt->oaddr)) diff --git a/fwd_rule.c b/fwd_rule.c index 5fc04d7..5bce2fb 100644 --- a/fwd_rule.c +++ b/fwd_rule.c @@ -465,6 +465,7 @@ static int parse_keyword(const char *s, const char **endptr, const char *kw) */ static void fwd_rule_range_except(struct fwd_table *fwd, bool del, uint8_t proto, const union inany_addr *addr, + const union inany_addr *daddr, const char *ifname, uint16_t first, uint16_t last, const uint8_t *exclude, uint16_t to, @@ -472,6 +473,7 @@ static void fwd_rule_range_except(struct fwd_table *fwd, bool del, { struct fwd_rule rule = { .addr = addr ? *addr : inany_any6, + .daddr = daddr ? *daddr : inany_any6, .ifname = { 0 }, .proto = proto, .flags = flags, @@ -544,13 +546,13 @@ fail: */ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto, const union inany_addr *addr, - const char *ifname, - const char *spec) + const char *ifname, char *spec) { + union inany_addr daddr_buf = inany_any6, *daddr = &daddr_buf; uint8_t exclude[PORT_BITMAP_SIZE] = { 0 }; bool exclude_only = true; - const char *p, *ep; uint8_t flags = 0; + char *p, *ep; unsigned i; if (!strcmp(spec, "all")) { @@ -568,7 +570,7 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto, continue; } - if (parse_keyword(p, &p, "auto") == 0) { + if (parse_keyword(p, (const char **)&p, "auto") == 0) { if (p != ep) /* Garbage after the keyword */ goto bad; @@ -586,7 +588,7 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto, goto bad; p++; - if (parse_port_range(p, &p, &xrange)) + if (parse_port_range(p, (const char **)&p, &xrange)) goto bad; if (p != ep) /* Garbage after the range */ goto bad; @@ -599,7 +601,7 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto, /* Exclude ephemeral ports */ fwd_port_map_ephemeral(exclude); - fwd_rule_range_except(fwd, del, proto, addr, ifname, + fwd_rule_range_except(fwd, del, proto, addr, NULL, ifname, 1, NUM_PORTS - 1, exclude, 1, flags | FWD_WEAK); return; @@ -613,11 +615,32 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto, /* Already parsed */ continue; - if (parse_port_range(p, &p, &orig_range)) + if (parse_port_range(p, (const char **)&p, &orig_range)) goto bad; - if (*p == ':') { /* There's a range to map to as well */ - if (parse_port_range(p + 1, &p, &mapped_range)) + if (*p == ':') { + /* There's a range or address to map to as well */ + char *addr_end = strchr(p, '/'); + + if (addr_end) { + *addr_end = '\0'; + + if (*p == '[' && p[strlen(p) - 1] == ']') { + p[strlen(p) - 1] = '\0'; + p++; + } + + if (!inany_pton(p + 1, daddr)) + die("Bad forwarding address '%s'", p); + + p = addr_end; + } else { + daddr = NULL; + } + + + if (parse_port_range(p + 1, (const char **)&p, + &mapped_range)) goto bad; if ((mapped_range.last - mapped_range.first) != (orig_range.last - orig_range.first)) @@ -629,7 +652,7 @@ static void fwd_rule_parse_ports(struct fwd_table *fwd, bool del, uint8_t proto, if (p != ep) /* Garbage after the ranges */ goto bad; - fwd_rule_range_except(fwd, del, proto, addr, ifname, + fwd_rule_range_except(fwd, del, proto, addr, daddr, ifname, orig_range.first, orig_range.last, exclude, mapped_range.first, flags); @@ -675,7 +698,8 @@ void fwd_rule_parse(char optname, bool del, const char *optarg, strncpy(buf, optarg, sizeof(buf) - 1); - if ((spec = strchr(buf, '/'))) { + if ((spec = strchr(buf, '/')) && + strchr(spec, ':') == strchr(buf, ':')) { *spec = 0; spec++; diff --git a/fwd_rule.h b/fwd_rule.h index ae9a3cb..3a2a809 100644 --- a/fwd_rule.h +++ b/fwd_rule.h @@ -35,6 +35,7 @@ /** * struct fwd_rule - Forwarding rule governing a range of ports * @addr: Address to forward from + * @daddr: Optional address to set as destination when forwarding * @ifname: Interface to forward from * @first: First port number to forward * @last: Last port number to forward @@ -47,6 +48,7 @@ */ struct fwd_rule { union inany_addr addr; + union inany_addr daddr; char ifname[IFNAMSIZ]; in_port_t first; in_port_t last; -- 2.43.0

2 5

[PATCH v3 00/12] Improvements to static checker invocation
by David Gibson 20 May '26

20 May '26

While working on pesto, I ran into a number of awkward errors with the static checkers. This series reworks the invocation of the checkers in a way that will let us deal with that. As a bonus, it also gives us static checking for passt-repair. It also a number of other cleanups to the Makefile that seemed natural along the way. v3: - Rework changes to $(FLAGS) so they're much less likely to have side effects we're not ready for. v2: - Fixed nasty test failure in test/build/build.py David Gibson (12): Makefile: Use make variables for static checker configuration Makefile: Make conditional definition of $(BIN) clearer Makefile: Use common binary compilation rule Makefile: Remove unhelpful $(HEADERS) variable Makefile: Add header dependencies for secondary binaries Makefile: Split $(FLAGS) into cpp and cc components cppcheck, clang-tidy: Static checkers don't need non-preprocessor flags Makefile: Split static checker targets passt-repair: Split out inotify handling to its own function passt-repair: Simplify construction of Unix path from inotify passt-repair: Run static checkers pesto: Run static checkers on pesto sources Makefile | 135 ++++++++++++++++++++++++-------------- linux_dep.h | 2 +- passt-repair.c | 171 +++++++++++++++++++++++++++---------------------- pesto.c | 1 - 4 files changed, 182 insertions(+), 127 deletions(-) -- 2.54.0

2 18

[PATCH v10 0/3] vhost-user,udp: Handle multiple iovec entries per virtqueue element
by Laurent Vivier 20 May '26

20 May '26

Some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. Currently, the RX (host to guest) path assumes a single iovec per element, which triggers: ASSERTION FAILED in virtqueue_map_desc (virtio.c:403): num_sg < max_num_sg This series reworks the UDP vhost-user receive path to support multiple iovec entries per element, fixing the iPXE crash. This series only addresses the UDP path. TCP vhost-user will be updated to use multi-iov elements in a subsequent series. Based-on: 20260513115218.1662850-1-lvivier(a)redhat.com v10: - udp_update_hdr4()/udp_update_hdr6(): take separate @uh pointer and @payload - udp_tap_prepare(): extract uh from UDP_IOV_PAYLOAD, @payload is UDP payload only - udp_vu_sock_recv(): extract UDP payload from the function - udp_vu_prepare(): take @payload as parameter, compute checksum conditionally via !*c->pcap instead of hardcoded true - udp_vu_csum(): removed v9: - iov_push_header_(): skip memcpy() when the source pointer already aliases the iov buffer - udp_update_hdr4()//udp_update_hdr6()/usp_csum(): update payload doc - udp_tap_prepare(): use existing (*tap_iov)[UDP_IOV_PAYLOAD] v8: - Add Reviewed-by from David for 1/3 and 2/3 - Remove VLA to use fixed size (VIRTQUEUE_MAX_SIZE) - Rename udp_frame to datagram - Use sizeof(uh) instead of sizeof(struct udphdr) - Push back uh in memory in udp_vu_csum() v7: - In udp_vu_sock_to_tap(), introduce iov_still_needed variable - Fix iov_tail @data doc comments in udp_vu_prepare()/udp_vu_csum() - Don't rewrap the virtio checksum comment in udp_update_hdr6() - Add NULL check for uh in udp_vu_csum() v6: - Rebased on top of [PATCH 00/10] vhost-user: Preparatory series for multiple iovec entries per virtqueue element v5: - This version doesn't change the padding system regarding v4, it's a complex task that will be addressed in another version - reorder patches and add new patches - remove IOV_PUT_HEADER()/with_header() and introduce IOV_PUSH_HEADER() - don't use the iov_tail to provide the headers to the functions - move vu_set_vnethdr() to vu_flush(), extract vu_queue_notify() - move vu_flush() inside loop in tcp_vu_data_from_sock() to flush data by frame and not by full data length v4: - rebase - replace ASSERT() by assert() v3: - include the series "Decouple iovec management from virtqueues elements" - because of this series, drop: "vu_common: Accept explicit iovec counts in vu_set_element()" "vu_common: Accept explicit iovec count per element in vu_init_elem()" "vu_common: Prepare to use multibuffer with guest RX" "vhost-user,udp: Use 2 iovec entries per element" - drop "vu_common: Pass iov_tail to vu_set_vnethdr()" as the specs insures a buffer is big enough to contain vnet header - introduce "with_header()" and merge "udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6()" and "udp_vu: Use iov_tail in udp_vu_prepare()" to use it v2: - add iov_truncate(), iov_memset() - remove iov_tail_truncate() and iov_tail_zero_end() - manage 802.3 minimum frame size Laurent Vivier (3): udp_vu: Allow virtqueue elements with multiple iovec entries iov: Introduce IOV_PUSH_HEADER() macro udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6() iov.c | 30 ++++++++++++ iov.h | 11 +++++ udp.c | 74 ++++++++++++++-------------- udp_internal.h | 6 ++- udp_vu.c | 129 +++++++++++++++++++------------------------------ 5 files changed, 131 insertions(+), 119 deletions(-) -- 2.54.0

2 4

Re: [PATCH v9 3/3] udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6()
by David Gibson 20 May '26

20 May '26

On Wed, May 20, 2026 at 11:07:50AM +1000, David Gibson wrote: > On Tue, May 19, 2026 at 10:03:39AM +0200, Laurent Vivier wrote: > > On 5/19/26 07:08, David Gibson wrote: > > > On Mon, May 18, 2026 at 02:26:25PM +0200, Laurent Vivier wrote: > > > > Change udp_update_hdr4() and udp_update_hdr6() to take an iov_tail > > > > pointing at the UDP frame instead of a contiguous udp_payload_t buffer > > > > and explicit data length. This lets vhost-user pass scatter-gather > > > > virtqueue buffers directly without an intermediate copy. > > > > > > > > The UDP header is built into a local struct udphdr and written back with > > > > IOV_PUSH_HEADER(). On the tap side, udp_tap_prepare() wraps the > > > > existing udp_payload_t in a two-element iov to match the new interface. > > > > > > > > Signed-off-by: Laurent Vivier <lvivier(a)redhat.com> > > > > > > Alas, this still has a potentially aliased memcpy(), see below. > > > > Did you see I updated patch 2 to avoid the memcpy() if the header is > > already in place? > > (I think I should have removed your R-b...) > > I saw the note in the changelog, but I didn't spot the place in the > code specifically - I think I skipped patch 2 because of the R-b and > assumed the change was in patch 3. Unfortunately the one in this > patch is still there. Duh, sorry, I misunderstood how you were fixing the problem. I see you changed PUSH_HEADER to be safe in this circumstance, which does also fix the case in patch 3. Will have that in mind when I review v10. -- David Gibson (he or they) | I'll have my music baroque, and my code david AT gibson.dropbear.id.au | minimalist, thank you, not the other way | around. http://www.ozlabs.org/~dgibson

1 0

[PATCH v2 0/3] More caution with NONBLOCK flag on Unix sockets
by David Gibson 20 May '26

20 May '26

This is a revision of the one patch from my pesto series that wasn't merged: a rework to the handling of the blocking flag for both listening and accepted Unix sockets. This new version is split into several pieces to make the rationales clearer at each step. It's also a bit more cautious in what it does, so should avoid the problems with the original version. David Gibson (3): treewide: Add SOCK_CLOEXEC to accept() calls that are missing it tap: Report accept() errors conf, repair, tap: Document reasons for blocking Unix sockets conf.c | 6 ++++++ repair.c | 9 +++++++-- tap.c | 13 +++++++++++-- 3 files changed, 24 insertions(+), 4 deletions(-) -- 2.54.0

2 5

[PATCH v9 0/3] vhost-user,udp: Handle multiple iovec entries per virtqueue element
by Laurent Vivier 20 May '26

20 May '26

Some virtio-net drivers (notably iPXE) provide descriptors where the vnet header and the frame payload are in separate buffers, resulting in two iovec entries per virtqueue element. Currently, the RX (host to guest) path assumes a single iovec per element, which triggers: ASSERTION FAILED in virtqueue_map_desc (virtio.c:403): num_sg < max_num_sg This series reworks the UDP vhost-user receive path to support multiple iovec entries per element, fixing the iPXE crash. This series only addresses the UDP path. TCP vhost-user will be updated to use multi-iov elements in a subsequent series. Based-on: 20260513115218.1662850-1-lvivier(a)redhat.com v9: - iov_push_header_(): skip memcpy() when the source pointer already aliases the iov buffer - udp_update_hdr4()//udp_update_hdr6()/usp_csum(): update payload doc - udp_tap_prepare(): use existing (*tap_iov)[UDP_IOV_PAYLOAD] v8: - Add Reviewed-by from David for 1/3 and 2/3 - Remove VLA to use fixed size (VIRTQUEUE_MAX_SIZE) - Rename udp_frame to datagram - Use sizeof(uh) instead of sizeof(struct udphdr) - Push back uh in memory in udp_vu_csum() v7: - In udp_vu_sock_to_tap(), introduce iov_still_needed variable - Fix iov_tail @data doc comments in udp_vu_prepare()/udp_vu_csum() - Don't rewrap the virtio checksum comment in udp_update_hdr6() - Add NULL check for uh in udp_vu_csum() v6: - Rebased on top of [PATCH 00/10] vhost-user: Preparatory series for multiple iovec entries per virtqueue element v5: - This version doesn't change the padding system regarding v4, it's a complex task that will be addressed in another version - reorder patches and add new patches - remove IOV_PUT_HEADER()/with_header() and introduce IOV_PUSH_HEADER() - don't use the iov_tail to provide the headers to the functions - move vu_set_vnethdr() to vu_flush(), extract vu_queue_notify() - move vu_flush() inside loop in tcp_vu_data_from_sock() to flush data by frame and not by full data length v4: - rebase - replace ASSERT() by assert() v3: - include the series "Decouple iovec management from virtqueues elements" - because of this series, drop: "vu_common: Accept explicit iovec counts in vu_set_element()" "vu_common: Accept explicit iovec count per element in vu_init_elem()" "vu_common: Prepare to use multibuffer with guest RX" "vhost-user,udp: Use 2 iovec entries per element" - drop "vu_common: Pass iov_tail to vu_set_vnethdr()" as the specs insures a buffer is big enough to contain vnet header - introduce "with_header()" and merge "udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6()" and "udp_vu: Use iov_tail in udp_vu_prepare()" to use it v2: - add iov_truncate(), iov_memset() - remove iov_tail_truncate() and iov_tail_zero_end() - manage 802.3 minimum frame size Laurent Vivier (3): udp_vu: Allow virtqueue elements with multiple iovec entries iov: Introduce IOV_PUSH_HEADER() macro udp: Pass iov_tail to udp_update_hdr4()/udp_update_hdr6() iov.c | 30 +++++++++++++ iov.h | 11 +++++ udp.c | 73 ++++++++++++++++--------------- udp_internal.h | 4 +- udp_vu.c | 116 ++++++++++++++++++++++++++----------------------- 5 files changed, 142 insertions(+), 92 deletions(-) -- 2.54.0

2 6

[PATCH] selinux: Allow pasta to create and use its control socket when started by Podman
by Stefano Brivio 19 May '26

19 May '26

If Podman starts us, we need to be able to create and use a UNIX domain socket file under ifconfig_var_run_t or container_var_run_t: add the related permissions. The failure reported by Jan would have been fixed by a simple: allow pasta_t ifconfig_var_run_t:sock_file create; but we'll need more than that for actual operation with pesto(1), and to cover all possible cases. Reported-by: Jan Rodák <jrodak(a)redhat.com> Link: https://github.com/containers/podman/pull/28478 Fixes: 533577008942 ("selinux: Add file context and type enforcement for pesto") Signed-off-by: Stefano Brivio <sbrivio(a)redhat.com> --- contrib/selinux/pasta.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/contrib/selinux/pasta.te b/contrib/selinux/pasta.te index fb51416..ff74dd7 100644 --- a/contrib/selinux/pasta.te +++ b/contrib/selinux/pasta.te @@ -253,6 +253,8 @@ allow pasta_t container_var_run_t:dir { add_name open rmdir write }; allow pasta_t ifconfig_var_run_t:dir { add_name open rmdir write }; allow pasta_t container_var_run_t:file { create open write }; allow pasta_t ifconfig_var_run_t:file { create open write }; +allow pasta_t container_var_run_t:sock_file { getattr create open read write }; +allow pasta_t ifconfig_var_run_t:sock_file { getattr create open read write }; allow systemd_user_runtimedir_t ifconfig_var_run_t:dir rmdir; # Allow pasta to bind to any port -- 2.43.0

1 0

[PATCH v2 2/3] tap: Report accept() errors
by David Gibson 18 May '26

18 May '26

Currently, if accept4() fails in tap_listen_handler(), we carry on as if it succeeded. Something will probably fail shortly down the line, but that's needlessly confusing. Report an error instead. Signed-off-by: David Gibson <david(a)gibson.dropbear.id.au> --- tap.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tap.c b/tap.c index e7cac9df..660f1cb6 100644 --- a/tap.c +++ b/tap.c @@ -1491,6 +1491,10 @@ void tap_listen_handler(struct ctx *c, uint32_t events) } c->fd_tap = accept4(c->fd_tap_listen, NULL, NULL, SOCK_CLOEXEC); + if (c->fd_tap < 0) { + warn_perror("Error accepting tap client"); + return; + } if (!getsockopt(c->fd_tap, SOL_SOCKET, SO_PEERCRED, &ucred, &len)) info("accepted connection from PID %i", ucred.pid); -- 2.54.0

1 0