Podman overrides TMPDIR to /var/tmp, and an upcoming change in the requires pasta to write its PID file to TMPDIR. To support this in the AppArmor policy, we need to loosen the existing rule restricting file writes to /tmp/ and subpaths in order to include common alternative paths for TMPDIR: the user-tmp abstraction does exactly this. Reported-by: Giuseppe Scrivano Link: https://github.com/podman-container-tools/container-libs/pull/1207 Signed-off-by: Stefano Brivio --- contrib/apparmor/usr.bin.passt | 3 +-- contrib/apparmor/usr.bin.pasta | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/contrib/apparmor/usr.bin.passt b/contrib/apparmor/usr.bin.passt index c123a86..da49e37 100644 --- a/contrib/apparmor/usr.bin.passt +++ b/contrib/apparmor/usr.bin.passt @@ -18,8 +18,7 @@ include profile passt /usr/bin/passt{,.avx2} { include - # Alternatively: include - owner /tmp/** w, # tap_sock_unix_open(), + include # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), diff --git a/contrib/apparmor/usr.bin.pasta b/contrib/apparmor/usr.bin.pasta index 56b5024..32dfad9 100644 --- a/contrib/apparmor/usr.bin.pasta +++ b/contrib/apparmor/usr.bin.pasta @@ -18,8 +18,7 @@ include profile pasta /usr/bin/pasta{,.avx2} flags=(attach_disconnected) { include - # Alternatively: include - /tmp/** rw, # tap_sock_unix_open(), + include # tap_sock_unix_open(), # tap_sock_unix_init(), pcap(), # pidfile_open(), # pidfile_write(), -- 2.43.0