nnd/selinux-refpolicy
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #467 from 0xC0ncord/docker-rootlesskit-optional

Browse Source 
docker: make rootlesskit optional
This commit is contained in:
Chris PeBenito 2022-01-24 20:44:22 -05:00 committed by GitHub
commit f84770f5ce
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
policy/modules/services/docker.if
View File

@ -178,8 +178,6 @@ template(`docker_user_role',`
docker_run_user_daemon($3, $4)
docker_run_user_cli($3, $4)
rootlesskit_role($1, $2, $3, $4)
ifdef(`init_systemd',`
systemd_user_daemon_domain($1, dockerd_exec_t, dockerd_user_t)
systemd_user_send_systemd_notify($1, dockerd_user_t)
@ -188,6 +186,10 @@ template(`docker_user_role',`
optional_policy(`
dbus_spec_session_bus_client($1, dockerd_user_t)
')
optional_policy(`
rootlesskit_role($1, $2, $3, $4)
')
')
########################################
@ -229,5 +231,7 @@ interface(`docker_signal_user_daemon',`
interface(`docker_admin',`
docker_run_cli($1, $2)
rootlesskit_run($1, $2)
optional_policy(`
rootlesskit_run($1, $2)
')
')

6
policy/modules/services/docker.te
View File

@ -125,8 +125,6 @@ mount_exec(dockerd_user_t)
container_setattr_container_ptys(dockerd_user_t)
container_use_container_ptys(dockerd_user_t)
rootlesskit_exec(dockerd_user_t)
ifdef(`init_systemd',`
systemd_search_user_runtime(dockerd_user_t)
systemd_write_user_runtime_socket(dockerd_user_t)
@ -140,6 +138,10 @@ optional_policy(`
dbus_write_session_runtime_socket(dockerd_user_t)
')
optional_policy(`
rootlesskit_exec(dockerd_user_t)
')
########################################
#
# Rootless Docker CLI local policy