Container selinux pull - #1
Open
singhsidha wants to merge 361 commits into
Open
Conversation
add VERSION file
…led. When you disable the unconfined module, lots of rules are removed from container runtime policy which also removes it from container_t, since it is typebounds. Adding these rules to container_runtime makes it more powerfull, but we ususally run it unconfined so it should not be a problem. Bottom line container_runtime_t has to be a superset of allow rules for container_t types.
Give container_t access to XFRM sockets
Note spec file is just an example. It is not the offical spec file.
Signed-off-by: rhatdan <dwalsh@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Allow sandbox containers manage fuse files.
Currently containers have some namespaced sysctls, which the kernel has determined to be safe for containers to use, this stops blocking these from an SELinux point of view. Also added missing container_runtime_t userns capabilities, so that policy will compile on systems with expand-check=1 Signed-off-by: Dan Walsh <dwalsh@redhat.com>
Customer is attempting to do the following Which is causing this issue.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
container.fc: label /etc/crio/...
Currently docker is creating containers with FIFO FILES leaked into the container, we need to allow the container access to these until we fix docker package to label the fifo files correctly. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Make sure that confined users can NOT run containers in spc_t domains. Only domains supported are container_t, container_init_t and container_kvm_t. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Allow container to relabel tun/tap device from container_runtime_t
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Original inclusion for container-selinux support in Ubuntu 20.04+
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Allow init containers to send syslog messages
Revert "Original inclusion for container-selinux support in Ubuntu 20.04+"
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Add nfs remount support
The container_filetrans_named_content macro calls out to the files_pid_filetrans macro for the "kata-containers" dir passing a type missing from the gen_require stanza. This is causing my downstream builds of rke2-selinux to fail (current work-around is to require container_kvm_var_run_t in our rke2_filetrans_named_content macro). Signed-off-by: Jacob Blain Christen <jacob@rancher.com>
…container-kvm-var-run-t adjust container_filetrans_named_content gen_require
The given object is later referenced by name anyway, so using those is no better than using gen_require() directly. We would like to remove these stub interfaces from selinux-policy. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Drop use of "stub" interfaces
Since non privileged users are able to write to /dev/random and /dev/urandom, I see no reason to block this with SELinux. Running systemd inside of a rootless container requires this. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Allow containers to write to /dev/rand, /dev/urand
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Allow unconfined domains to talk to unlabled sockets
Just realized we were missing the SECURITY.md here, this adds it. Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
Add SECURITY.md
allow (most) binaries to live in sbin and bin directories
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.