nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

container: add type for container plugins

Browse Source 
Signed-off-by: Kenton Groombridge <me@concord.sh>
This commit is contained in:
Kenton Groombridge 2022-06-07 16:07:58 -04:00
parent 16a928df4e
commit 466ea4b323
3 changed files with 67 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
policy/modules/services/container.fc
View File

@ -30,6 +30,8 @@ HOME_DIR/\.docker(/.*)? gen_context(system_u:object_r:container_conf_home_t,s0)
/usr/sbin/runc -- gen_context(system_u:object_r:container_engine_exec_t,s0)
/opt/cni(/.*)? gen_context(system_u:object_r:container_plugin_t,s0)
/etc/containers(/.*)? gen_context(system_u:object_r:container_config_t,s0)
/etc/cni(/.*)? gen_context(system_u:object_r:container_config_t,s0)
/etc/docker(/.*)? gen_context(system_u:object_r:container_config_t,s0)

59
policy/modules/services/container.if
View File

@ -772,6 +772,65 @@ interface(`container_mountpoint',`
typeattribute $1 container_mountpoint_type;
')
########################################
## <summary>
## Allow the specified domain to
## list the contents of container
## plugin directories.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`container_list_plugins',`
gen_require(`
type container_plugin_t;
')
allow $1 container_plugin_t:dir list_dir_perms;
')
########################################
## <summary>
## Allow the specified domain to
## manage container plugin files.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`container_manage_plugin_files',`
gen_require(`
type container_plugin_t;
')
allow $1 container_plugin_t:file manage_file_perms;
')
########################################
## <summary>
## Allow the specified domain to
## execute container plugins.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`container_exec_plugins',`
gen_require(`
type container_plugin_t;
')
container_list_plugins($1)
can_exec($1, container_plugin_t)
')
########################################
## <summary>
## Allow the specified domain to

6
policy/modules/services/container.te
View File

@ -135,6 +135,12 @@ logging_log_file(container_log_t)
type container_devpts_t;
term_pty(container_devpts_t)
type container_plugin_t;
corecmd_executable_file(container_plugin_t)
optional_policy(`
kubernetes_mountpoint(container_plugin_t)
')
type container_file_t alias svirt_lxc_file_t;
dev_node(container_file_t)
files_mountpoint(container_file_t)