[PATCH] NEWS: note new passt feature & bugfix for 9.1.0 release

[Andrea Bolognani]

On Tue, Feb 28, 2023 at 07:53:09PM +0100, Stefano Brivio wrote:
> On Tue, 28 Feb 2023 10:06:18 -0800 Andrea Bolognani <abologna at redhat.com> wrote:
> > On Tue, Feb 28, 2023 at 09:49:26AM -0500, Laine Stump wrote:
> > > +    (NB: it is still necessary to disable SELinux to start passt.)
> >
> > This is also true for AppArmor, so I would mention both.
>
> Not in general -- thankfully, no pseudorandom label is forced by
> libvirt 9.1.0 with AppArmor (because there are no labels), and libvirtd
> simply runs passt unconfined (scrubbing the environment):
>
> $ grep "/usr/bin" src/security/apparmor/usr.sbin.libvirtd.in
>   /usr/bin/* PUx,
>
> Then yes, with any recent version of Debian and openSUSE packages of
> passt, passt won't be able to create the socket or its PID file in the
> path libvirt asks for, because of the profile shipping with passt
> itself.

>From the user's point of view, what is the difference between passt
not being able to start, or starting successfully but quitting
immediately afterwards because it can't create some files? I don't
think there's one. In both cases, you're going to see an error.

> Note that I'm *not* recommending to do this, just like I'm not
> recommending to disable SELinux, and I don't think it's a good idea to
> suggest in release notes that users do this, either.

This is a limitation of the current implementation of passt support
in libvirt. We're actively working on removing it, but in the
meantime it should be documented somewhere. Are the release notes the
best place for that? Unclear. I don't think it's a particularly bad
one. Anyone reading "you need to disable SELinux to use this feature"
will surely infer that they shouldn't put it into production yet :)

-- 
Andrea Bolognani / Red Hat / Virtualization