367 lines
7.4 KiB
Plaintext
367 lines
7.4 KiB
Plaintext
## <summary>Policy for podman</summary>
|
|
|
|
########################################
|
|
## <summary>
|
|
## Template for conmon domains.
|
|
## </summary>
|
|
## <param name="prefix">
|
|
## <summary>
|
|
## Prefix for generated types.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="source_domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
template(`podman_conmon_domain_template',`
|
|
gen_require(`
|
|
attribute conmon_domain;
|
|
type conmon_exec_t;
|
|
')
|
|
|
|
type $1_conmon_t, conmon_domain;
|
|
application_domain($1_conmon_t, conmon_exec_t)
|
|
|
|
domtrans_pattern($2, conmon_exec_t, $1_conmon_t)
|
|
|
|
allow $2 $1_conmon_t:process signull;
|
|
allow $2 $1_conmon_t:fifo_file setattr;
|
|
allow $2 $1_conmon_t:unix_stream_socket { connectto rw_stream_socket_perms };
|
|
|
|
allow $1_conmon_t $2:tcp_socket rw_stream_socket_perms;
|
|
allow $1_conmon_t $2:unix_stream_socket rw_stream_socket_perms;
|
|
allow $1_conmon_t $2:unix_dgram_socket rw_socket_perms;
|
|
ps_process_pattern($1_conmon_t, $2)
|
|
|
|
corecmd_search_bin($1_conmon_t)
|
|
# conmon will execute crun/runc to create the container,
|
|
# so transition back to the source domain when creating it
|
|
container_generic_engine_domtrans($1_conmon_t, $2)
|
|
container_engine_executable_entrypoint($2)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute podman in the podman domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_domtrans',`
|
|
gen_require(`
|
|
type podman_t, podman_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, podman_exec_t, podman_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute podman in the podman domain,
|
|
## and allow the specified role the
|
|
## podman domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## The role to be allowed the podman domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_run',`
|
|
gen_require(`
|
|
type podman_t;
|
|
')
|
|
|
|
role $2 types podman_t;
|
|
|
|
podman_domtrans($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute podman in the podman user
|
|
## domain (rootless podman).
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_domtrans_user',`
|
|
gen_require(`
|
|
type podman_user_t, podman_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, podman_exec_t, podman_user_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute podman in the podman user
|
|
## domain, and allow the specified role
|
|
## the podman user domain (rootless
|
|
## podman).
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## The role to be allowed the podman domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_run_user',`
|
|
gen_require(`
|
|
type podman_user_t;
|
|
')
|
|
|
|
role $2 types podman_user_t;
|
|
|
|
podman_domtrans_user($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute conmon in the podman conmon domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_domtrans_conmon',`
|
|
gen_require(`
|
|
type podman_conmon_t, conmon_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, conmon_exec_t, podman_conmon_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute conmon in the podman conmon
|
|
## domain, and allow the specified role
|
|
## the podman conmon domain.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## The role to be allowed the conmon domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_run_conmon',`
|
|
gen_require(`
|
|
type podman_conmon_t;
|
|
')
|
|
|
|
role $2 types podman_conmon_t;
|
|
|
|
podman_domtrans_conmon($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute conmon in the podman conmon
|
|
## user domain (rootless podman).
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_domtrans_conmon_user',`
|
|
gen_require(`
|
|
type podman_user_conmon_t, conmon_exec_t;
|
|
')
|
|
|
|
corecmd_search_bin($1)
|
|
domtrans_pattern($1, conmon_exec_t, podman_user_conmon_t)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Execute conmon in the podman conmon
|
|
## user domain, and allow the specified
|
|
## role the podman conmon user domain
|
|
## (rootless podman).
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed to transition.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## The role to be allowed the conmon domain.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_run_conmon_user',`
|
|
gen_require(`
|
|
type podman_user_conmon_t;
|
|
')
|
|
|
|
role $2 types podman_user_conmon_t;
|
|
|
|
podman_domtrans_conmon_user($1)
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Make the specified domain perform a
|
|
## range transition when executing conmon.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain to transition ranges.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="range">
|
|
## <summary>
|
|
## MLS range to transition to.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_spec_rangetrans_conmon',`
|
|
gen_require(`
|
|
type conmon_exec_t;
|
|
')
|
|
|
|
ifdef(`enable_mcs',`
|
|
range_transition $1 conmon_exec_t:process $2;
|
|
')
|
|
ifdef(`enable_mls',`
|
|
range_transition $1 conmon_exec_t:process $2;
|
|
')
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Read and write conmon unnamed pipes.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_rw_conmon_pipes',`
|
|
gen_require(`
|
|
attribute conmon_domain;
|
|
')
|
|
|
|
allow $1 conmon_domain:fifo_file rw_fifo_file_perms;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Allow the specified domain to inherit
|
|
## and use file descriptors from conmon.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
#
|
|
interface(`podman_use_conmon_fds',`
|
|
gen_require(`
|
|
attribute conmon_domain;
|
|
')
|
|
|
|
allow $1 conmon_domain:fd use;
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## Role access for rootless podman.
|
|
## </summary>
|
|
## <param name="role_prefix">
|
|
## <summary>
|
|
## The prefix of the user role (e.g., user
|
|
## is the prefix for user_r).
|
|
## </summary>
|
|
## </param>
|
|
## <param name="user_domain">
|
|
## <summary>
|
|
## User domain for the role.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="user_exec_domain">
|
|
## <summary>
|
|
## User exec domain for execute and transition access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
template(`podman_user_role',`
|
|
gen_require(`
|
|
type podman_user_t;
|
|
type podman_user_conmon_t;
|
|
')
|
|
|
|
podman_run_user($3, $4)
|
|
podman_run_conmon_user($3, $4)
|
|
|
|
optional_policy(`
|
|
dbus_spec_session_bus_client($1, podman_user_t)
|
|
')
|
|
|
|
optional_policy(`
|
|
systemd_user_app_status($1, podman_user_t)
|
|
systemd_user_app_status($1, podman_user_conmon_t)
|
|
')
|
|
')
|
|
|
|
########################################
|
|
## <summary>
|
|
## All of the rules required to
|
|
## administrate a podman
|
|
## environment.
|
|
## </summary>
|
|
## <param name="domain">
|
|
## <summary>
|
|
## Domain allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <param name="role">
|
|
## <summary>
|
|
## Role allowed access.
|
|
## </summary>
|
|
## </param>
|
|
## <rolecap/>
|
|
#
|
|
interface(`podman_admin',`
|
|
podman_run($1, $2)
|
|
podman_run_conmon($1, $2)
|
|
')
|