From 466ea4b323872072e2bbfe60c16116c0ffa4cca4 Mon Sep 17 00:00:00 2001
From: Kenton Groombridge <me@concord.sh>
Date: Tue, 7 Jun 2022 16:07:58 -0400
Subject: [PATCH] container: add type for container plugins

Signed-off-by: Kenton Groombridge <me@concord.sh>
---
 policy/modules/services/container.fc |  2 +
 policy/modules/services/container.if | 59 ++++++++++++++++++++++++++++
 policy/modules/services/container.te |  6 +++
 3 files changed, 67 insertions(+)

diff --git a/policy/modules/services/container.fc b/policy/modules/services/container.fc
index b8d06cd55..feb2efd5b 100644
--- a/policy/modules/services/container.fc
+++ b/policy/modules/services/container.fc
@@ -30,6 +30,8 @@ HOME_DIR/\.docker(/.*)?		gen_context(system_u:object_r:container_conf_home_t,s0)
 
 /usr/sbin/runc	--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 
+/opt/cni(/.*)?		gen_context(system_u:object_r:container_plugin_t,s0)
+
 /etc/containers(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
 /etc/cni(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
 /etc/docker(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
diff --git a/policy/modules/services/container.if b/policy/modules/services/container.if
index ba1e56b44..fe9010ceb 100644
--- a/policy/modules/services/container.if
+++ b/policy/modules/services/container.if
@@ -772,6 +772,65 @@ interface(`container_mountpoint',`
 	typeattribute $1 container_mountpoint_type;
 ')
 
+########################################
+## <summary>
+##	Allow the specified domain to
+##	list the contents of container
+##	plugin directories.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`container_list_plugins',`
+	gen_require(`
+		type container_plugin_t;
+	')
+
+	allow $1 container_plugin_t:dir list_dir_perms;
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to
+##	manage container plugin files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`container_manage_plugin_files',`
+	gen_require(`
+		type container_plugin_t;
+	')
+
+	allow $1 container_plugin_t:file manage_file_perms;
+')
+
+########################################
+## <summary>
+##	Allow the specified domain to
+##	execute container plugins.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`container_exec_plugins',`
+	gen_require(`
+		type container_plugin_t;
+	')
+
+	container_list_plugins($1)
+	can_exec($1, container_plugin_t)
+')
+
 ########################################
 ## <summary>
 ##	Allow the specified domain to
diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te
index ac1bf0469..f02507ce2 100644
--- a/policy/modules/services/container.te
+++ b/policy/modules/services/container.te
@@ -135,6 +135,12 @@ logging_log_file(container_log_t)
 type container_devpts_t;
 term_pty(container_devpts_t)
 
+type container_plugin_t;
+corecmd_executable_file(container_plugin_t)
+optional_policy(`
+	kubernetes_mountpoint(container_plugin_t)
+')
+
 type container_file_t alias svirt_lxc_file_t;
 dev_node(container_file_t)
 files_mountpoint(container_file_t)