nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #482 from 0xC0ncord/podman-conmon-ranged-transition

Browse Source 
podman: add explicit range transition for conmon
This commit is contained in:
Chris PeBenito 2022-03-18 15:30:53 -04:00 committed by GitHub
commit 2f2c0e3f20
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
policy/modules/services/podman.te
View File

@ -190,6 +190,14 @@ container_engine_tmp_filetrans(podman_conmon_t, { file sock_file })
container_manage_engine_tmp_files(podman_conmon_t)
container_manage_engine_tmp_sock_files(podman_conmon_t)
# Ensure conmon runs in s0 so that it can talk to the container
ifdef(`enable_mcs',`
range_transition podman_t podman_conmon_exec_t:process s0;
')
ifdef(`enable_mls',`
range_transition podman_t podman_conmon_exec_t:process s0;
')
ifdef(`init_systemd',`
init_get_generic_units_status(podman_conmon_t)
init_start_generic_units(podman_conmon_t)
@ -261,6 +269,14 @@ container_engine_tmp_filetrans(podman_conmon_user_t, { file sock_file })
container_manage_engine_tmp_files(podman_conmon_user_t)
container_manage_engine_tmp_sock_files(podman_conmon_user_t)
# Ensure conmon runs in s0 so that it can talk to the container
ifdef(`enable_mcs',`
range_transition podman_user_t podman_conmon_exec_t:process s0;
')
ifdef(`enable_mls',`
range_transition podman_user_t podman_conmon_exec_t:process s0;
')
ifdef(`init_systemd',`
# conmon can read logs from containers which are
# sent to the system journal