nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

container: add missing filetrans and filecon for containerd/docker

Browse Source 
Add a missing file transition for the docker socket in /run as well as a
missing file context for /var/log/containerd.

Thanks-to: zen_desu
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2023-02-10 13:30:56 -05:00
parent cd8b67a066
commit 7ec913312b
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
policy/modules/services/container.fc
View File

@ -100,6 +100,7 @@ HOME_DIR/\.docker(/.*)? gen_context(system_u:object_r:container_conf_home_t,s0)
/var/lib/etcd(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/lib/kube-proxy(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/log/containerd(/.*)? gen_context(system_u:object_r:container_log_t,s0)
/var/log/containers(/.*)? gen_context(system_u:object_r:container_log_t,s0)
/var/log/crio(/.*)? gen_context(system_u:object_r:container_log_t,s0)
/var/log/pods(/.*)? gen_context(system_u:object_r:container_log_t,s0)

2
policy/modules/services/container.te
View File

@ -747,7 +747,7 @@ allow container_engine_system_domain container_runtime_t:file { manage_file_perm
allow container_engine_system_domain container_runtime_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
allow container_engine_system_domain container_runtime_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
allow container_engine_system_domain container_runtime_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
files_runtime_filetrans(container_engine_system_domain, container_runtime_t, { dir file })
files_runtime_filetrans(container_engine_system_domain, container_runtime_t, { dir file sock_file })
allow container_engine_system_domain container_engine_cache_t:dir manage_dir_perms;
allow container_engine_system_domain container_engine_cache_t:file manage_file_perms;