selinux-refpolicy/policy/modules/services/podman.if

371 lines
7.5 KiB
Plaintext

## <summary>Policy for podman</summary>
########################################
## <summary>
## Template for conmon domains.
## </summary>
## <param name="prefix">
## <summary>
## Prefix for generated types.
## </summary>
## </param>
## <param name="source_domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
template(`podman_conmon_domain_template',`
gen_require(`
attribute conmon_domain;
type conmon_exec_t;
')
type $1_conmon_t, conmon_domain;
application_domain($1_conmon_t, conmon_exec_t)
domtrans_pattern($2, conmon_exec_t, $1_conmon_t)
allow $2 $1_conmon_t:process signull;
allow $2 $1_conmon_t:fifo_file setattr;
allow $2 $1_conmon_t:unix_stream_socket { connectto rw_stream_socket_perms };
allow $1_conmon_t $2:tcp_socket rw_stream_socket_perms;
allow $1_conmon_t $2:unix_stream_socket rw_stream_socket_perms;
allow $1_conmon_t $2:unix_dgram_socket rw_socket_perms;
ps_process_pattern($1_conmon_t, $2)
corecmd_search_bin($1_conmon_t)
# conmon will execute crun/runc to create the container,
# so transition back to the source domain when creating it
container_generic_engine_domtrans($1_conmon_t, $2)
container_engine_executable_entrypoint($2)
')
########################################
## <summary>
## Execute podman in the podman domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`podman_domtrans',`
gen_require(`
type podman_t, podman_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, podman_exec_t, podman_t)
')
########################################
## <summary>
## Execute podman in the podman domain,
## and allow the specified role the
## podman domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to be allowed the podman domain.
## </summary>
## </param>
#
interface(`podman_run',`
gen_require(`
type podman_t;
')
role $2 types podman_t;
podman_domtrans($1)
')
########################################
## <summary>
## Execute podman in the podman user
## domain (rootless podman).
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`podman_domtrans_user',`
gen_require(`
type podman_user_t, podman_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, podman_exec_t, podman_user_t)
')
########################################
## <summary>
## Execute podman in the podman user
## domain, and allow the specified role
## the podman user domain (rootless
## podman).
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to be allowed the podman domain.
## </summary>
## </param>
#
interface(`podman_run_user',`
gen_require(`
type podman_user_t;
')
role $2 types podman_user_t;
podman_domtrans_user($1)
')
########################################
## <summary>
## Execute conmon in the podman conmon domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`podman_domtrans_conmon',`
gen_require(`
type podman_conmon_t, conmon_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, conmon_exec_t, podman_conmon_t)
')
########################################
## <summary>
## Execute conmon in the podman conmon
## domain, and allow the specified role
## the podman conmon domain.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to be allowed the conmon domain.
## </summary>
## </param>
#
interface(`podman_run_conmon',`
gen_require(`
type podman_conmon_t;
')
role $2 types podman_conmon_t;
podman_domtrans_conmon($1)
')
########################################
## <summary>
## Execute conmon in the podman conmon
## user domain (rootless podman).
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
#
interface(`podman_domtrans_conmon_user',`
gen_require(`
type podman_user_conmon_t, conmon_exec_t;
')
corecmd_search_bin($1)
domtrans_pattern($1, conmon_exec_t, podman_user_conmon_t)
')
########################################
## <summary>
## Execute conmon in the podman conmon
## user domain, and allow the specified
## role the podman conmon user domain
## (rootless podman).
## </summary>
## <param name="domain">
## <summary>
## Domain allowed to transition.
## </summary>
## </param>
## <param name="role">
## <summary>
## The role to be allowed the conmon domain.
## </summary>
## </param>
#
interface(`podman_run_conmon_user',`
gen_require(`
type podman_user_conmon_t;
')
role $2 types podman_user_conmon_t;
podman_domtrans_conmon_user($1)
')
########################################
## <summary>
## Make the specified domain perform a
## range transition when executing conmon.
## </summary>
## <param name="domain">
## <summary>
## Domain to transition ranges.
## </summary>
## </param>
## <param name="range">
## <summary>
## MLS range to transition to.
## </summary>
## </param>
#
interface(`podman_spec_rangetrans_conmon',`
gen_require(`
type conmon_exec_t;
')
ifdef(`enable_mcs',`
range_transition $1 conmon_exec_t:process $2;
')
ifdef(`enable_mls',`
range_transition $1 conmon_exec_t:process $2;
')
')
########################################
## <summary>
## Read and write podman conmon unnamed pipes.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`podman_rw_conmon_pipes',`
gen_require(`
type podman_conmon_t;
type podman_user_conmon_t;
')
allow $1 podman_conmon_t:fifo_file rw_fifo_file_perms;
allow $1 podman_user_conmon_t:fifo_file rw_fifo_file_perms;
')
########################################
## <summary>
## Allow the specified domain to inherit
## file descriptors from podman conmon.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`podman_use_conmon_fds',`
gen_require(`
type podman_conmon_t;
type podman_user_conmon_t;
')
allow $1 podman_conmon_t:fd use;
allow $1 podman_user_conmon_t:fd use;
')
########################################
## <summary>
## Role access for rootless podman.
## </summary>
## <param name="role_prefix">
## <summary>
## The prefix of the user role (e.g., user
## is the prefix for user_r).
## </summary>
## </param>
## <param name="user_domain">
## <summary>
## User domain for the role.
## </summary>
## </param>
## <param name="user_exec_domain">
## <summary>
## User exec domain for execute and transition access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
template(`podman_user_role',`
gen_require(`
type podman_user_t;
type podman_user_conmon_t;
')
podman_run_user($3, $4)
podman_run_conmon_user($3, $4)
optional_policy(`
dbus_spec_session_bus_client($1, podman_user_t)
')
optional_policy(`
systemd_user_app_status($1, podman_user_t)
systemd_user_app_status($1, podman_user_conmon_t)
')
')
########################################
## <summary>
## All of the rules required to
## administrate a podman
## environment.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
## <param name="role">
## <summary>
## Role allowed access.
## </summary>
## </param>
## <rolecap/>
#
interface(`podman_admin',`
podman_run($1, $2)
podman_run_conmon($1, $2)
')