Container selinux pull - #1

Open

singhsidha wants to merge 361 commits into

mgrepl:masterfrom

containers:master

This pull request is big! We're only showing the most recent 250 commits

Commits on Feb 10, 2017

Merge pull request #30 from lsm5/master
rhatdan
authored
365779b

Commits on Feb 12, 2017

Add rules to allow container_runtimes to run with unconfined disabled
rhatdan
committed
d6b1c18
Merge branch 'master' of github.com:projectatomic/container-selinux
rhatdan
committed
aa153c7
bUMP TO V2.9
rhatdan
committed
08bb6e0

Commits on Feb 24, 2017

Label files under /usr/libexec/lxc as container_runtime_exec_t
rhatdan
committed
46648d7

Commits on Feb 27, 2017

container_runtime_t Rules needed to work with unconfined module disabled.
rhatdan
committed
132fee4

Commits on Feb 28, 2017

Additional rules to allow a container runtime to run with unconfined disabled
rhatdan
committed
4e082db
Allow containers to read cgroup configuration mounted into a container
rhatdan
committed
c9829f9
Bump to v2.10
rhatdan
committed
8f8caa6

Commits on Mar 6, 2017

Give container_t access to XFRM sockets
joshwget
committed
254d8ea
Allow spc_t to dbus chat with init system
rhatdan
committed
3c7c435
Merge pull request #33 from joshwget/xfrm-sockets
rhatdan
authored
c1fd491

Commits on Mar 13, 2017

Move spec file into a contrib subdir
rhatdan
committed
c41f492

Commits on Apr 10, 2017

Commits on Apr 26, 2017

Fixes to make container_runtimes work on MLS machines
rhatdan
committed
a68dc2f

Commits on May 3, 2017

Allow sandbox containers manage fuse files.
wrabcak
committed
ee260f3

Commits on May 4, 2017

Merge pull request #36 from wrabcak/master
eparis
authored
781bf81

Commits on May 16, 2017

Commits on May 19, 2017

Add labels for crio rename
rhatdan
committed
14f7c51

Commits on May 30, 2017

Allow a container runtime to mount on top of its own /proc
rhatdan
committed
aea2b9b

Commits on May 31, 2017

Allow container types to read/write container_runtime fifo files
rhatdan
committed
1a02b84
Bumb Version to 2.15
rhatdan
committed
c81ea26

Commits on Jun 1, 2017

container.fc: label /etc/crio/...
runcom
committed
56ef1b4
Merge pull request #40 from runcom/etc-crio
rhatdan
authored
38bd98f
Bump to version 2.16.0
rhatdan
committed
9027f8e

Commits on Jun 5, 2017

Don't range the container_runtime_t in targeted policy
rhatdan
committed
ed3082b

Commits on Jun 6, 2017

Label content in /var/lib/contaienrs/storage/overlay* correctly
rhatdan
committed
5212fea

Commits on Jun 12, 2017

Allow containers to create tunnel sockets.
rhatdan
committed
d72cc6d
Create new version for tunnel sockets
rhatdan
committed
a80afba

Commits on Jun 15, 2017

Add interface to allow the reading of the container runtime state
rhatdan
committed
b22d151

Commits on Jun 30, 2017

Allow container processes to getsession
rhatdan
committed
c5fd77f

Commits on Jul 5, 2017

Add temporary rules to allow iptables to work with containers.
rhatdan
committed
288f4ad

Commits on Jul 11, 2017

Allow container processes to execmod on container_share_t files.
rhatdan
committed
c89e9b5

Commits on Sep 5, 2017

Add additional labels for containers storage
rhatdan
committed
58324f3

Commits on Sep 7, 2017

Allow container runtime to create socket files in tmp directories
rhatdan
committed
81ff96c

Commits on Sep 22, 2017

Make sure container_runtime_t has all access of container_t
rhatdan
committed
a9260d4

Commits on Sep 26, 2017

Add support for LXD
Conan-Kudo
committed
1b03ba3
Allow spc_t domains to trransition to svirt_t
rhatdan
committed
efaffbd

Commits on Sep 27, 2017

Allow container_file_t to be an entrypoint for VM's
rhatdan
committed
23b2e0b

Commits on Oct 4, 2017

Allow container runtimes to work with the netfilter sockets
rhatdan
committed
e37e93d

Commits on Oct 9, 2017

Allow a container to umount a container_file_t filesystem
rhatdan
committed
de38c07

Commits on Oct 10, 2017

Commits on Oct 11, 2017

add dontaudit rules for container trying to write to /proc
rhatdan
committed
0d05a62

Commits on Oct 26, 2017

Allow the container runtime to dbus chat with dnsmasq
rhatdan
committed
47e0448

Commits on Nov 8, 2017

Make sure users creating content in /var/lib with right labels
rhatdan
committed
b430a71

Commits on Nov 19, 2017

Allow containers to read /etc/resolv.conf volume mounted in from the host
rhatdan
committed
0b666c4

Commits on Nov 22, 2017

Dontaudit gettattr on file systems
rhatdan
committed
7fe0136

Commits on Nov 27, 2017

Commits on Dec 12, 2017

Allow containers to use inherited terminals.
rhatdan
committed
8ba32a4

Commits on Jan 6, 2018

Allow container runtimes to mmap container_file_t devices
rhatdan
committed
26c642a

Commits on Jan 8, 2018

Allow container runtimes to use inherited ttys
rhatdan
committed
96e58bf

Commits on Jan 9, 2018

Allow container_runtime_t to use user ptys
rhatdan
committed
599072a
Fix type bounds rules
rhatdan
committed
0422c80
Remove typebounds checking. Now we use nnp_transition
rhatdan
committed
231b213

Commits on Jan 11, 2018

No longer need entrypoint calls since we are using nnp_transition rules
rhatdan
committed
c069765

Commits on Jan 16, 2018

Allow unconfined domains to transition to container types when no-new-privs
rhatdan
committed
d148550

Commits on Jan 22, 2018

Allow containers to map the container_runtime_t fifo_files leaked into the container
rhatdan
committed
dfcc97d

Commits on Jan 29, 2018

Allow container domains to read kernel ipc info
rhatdan
committed
38a982b

Commits on Feb 2, 2018

Allow containers to create stream sockets and send packets to them
rhatdan
committed
5d87e01
Bump to v2.45
rhatdan
committed
95b7c01

Commits on Feb 3, 2018

Add support for nosuid_trnasitions
rhatdan
committed
2377c73

Commits on Feb 9, 2018

container.fc: label system containers /exports as container_config_t
giuseppe
committed
926a4c9

Commits on Feb 10, 2018

Merge pull request #50 from giuseppe/exports-system-containers
rhatdan
authored
9f73a97
Bump to 2.47.0
rhatdan
committed
aece4ff

Commits on Feb 15, 2018

Allow container domains to map container_file_t directories
rhatdan
committed
663e003

Commits on Mar 2, 2018

Add rules for running container runtimes on mls
rhatdan
committed
08e95ca

Commits on Mar 7, 2018

Allow bin_t as an entrypoint
rhatdan
committed
fd7d508

Commits on Mar 8, 2018

Allow shell_exec_t as an entrypoint for container_runtime_t
rhatdan
committed
fd50128
Add new rules for making writing custom container domains easier
rhatdan
committed
bdc0137
Addition default rules for container domains
rhatdan
committed
6c43f97

Commits on Mar 12, 2018

Allow spc_t to change attributes on container_runtime_t fifo files
rhatdan
committed
55c7d4d

Commits on Mar 15, 2018

Dontaudit attempts to write to the /proc/self directories
rhatdan
committed
d248f91

Commits on May 18, 2018

Label podman as a container_runtime_exec_t so it can be run from init
rhatdan
committed
d213769

Commits on May 21, 2018

Allow unconfined_service_t to transition to container_runtime_t
rhatdan
committed
701557f
Allow containers to list cgroup_t directories
rhatdan
committed
97f8dfc
Allow spc_t to load kernel modules from inside of container
rhatdan
committed
9b55129

Commits on May 24, 2018

Add labeling for /var/lib/containers/overlay[2] to container_share_t
rhatdan
committed
1ecf953

Commits on May 30, 2018

Allow containers to create icmp packets
rhatdan
committed
284f9e7

Commits on Jun 3, 2018

Allow containers to create all socket classes
rhatdan
committed
d346375

Commits on Jun 6, 2018

Add new type to support userns
rhatdan
committed
d07430e

Commits on Jun 11, 2018

Allow containers to map all socket types
rhatdan
committed
c53c010
Merge pull request #53 from projectatomic/userns
rhatdan
authored
dfaf8fd

Commits on Jun 30, 2018

Allow container runtimes to dbus chat with systemd-resolvd
rhatdan
committed
ea9e288
Bumb to version 2.66
rhatdan
committed
8ecc282

Commits on Jul 6, 2018

Add container_logreader_t type
rhatdan
committed
0407867

Commits on Jul 9, 2018

Fix typo
Weiwei Jiang
authored
edb5f9a
Merge pull request #54 from wjiangjay/patch-1
rhatdan
authored
042f7cf

Commits on Jul 16, 2018

Change /var/lib/origin label to be container_file_t
rhatdan
committed
25277c8

Commits on Jul 17, 2018

Fix missing require for container_file_t type in container_filetrans_named_content() interface
wrabcak
committed
c139a3d

Commits on Jul 25, 2018

Dontaudit attempts to write to kernel sysctls
rhatdan
committed
452b90d

Commits on Aug 22, 2018

Allow unconfined_t domains to transition to container_runtime_t
rhatdan
committed
4e73492

Commits on Aug 23, 2018

Transition unconfined_r to system_r when executing container_runtime_exec_t
rhatdan
committed
5721d74

Commits on Sep 12, 2018

Allow containre_runime_t to setatt on callers fifo_files
rhatdan
committed
f6c7f41
Setup spc_t as a container domain
rhatdan
committed
d7a3f33

Commits on Oct 18, 2018

Allow container_t to call setxec on process
cjeanner
committed
de8020d

Commits on Oct 19, 2018

Merge pull request #56 from cjeanner/container/setexec
rhatdan
authored
a62c2db

Commits on Oct 30, 2018

Allow container domains to use fuse file systems by default
rhatdan
committed
99e2cfd

Commits on Dec 11, 2018

Allow runc to access setattr on the fifo_file
EmilienM
committed
ae6e25b

Commits on Dec 17, 2018

Merge pull request #59 from EmilienM/issue/1980
rhatdan
authored
125faa2
update version
rhatdan
committed
5133af6
Fix handling of unconfined_service_t transition rules
rhatdan
committed
2c57a17

Commits on Jan 11, 2019

Add labeling for /var/lib/registry
rhatdan
committed
6f01752

Commits on Jan 22, 2019

Don't allow container domains to connect to container runtimes
rhatdan
committed
1b655d9

Commits on Feb 7, 2019

Add containerd paths
justincormack
committed
4f9d78d
Merge pull request #64 from justincormack/containerd-move
rhatdan
authored
21c2be6
Bump to version 2.81
rhatdan
committed
484806a

Commits on Feb 10, 2019

Allow confined users to run containers
rhatdan
committed
5e1f62f

Commits on Feb 25, 2019

Containers need mounton cgroups_t/container_file_t.
rhatdan
committed
ec6fcad

Commits on Feb 28, 2019

Commits on Mar 1, 2019

Commits on Mar 5, 2019

Dontaudit containers to inherit limits and signal state from
wrabcak
committed
14cb4e5
Merge pull request #65 from wrabcak/dontaudit
rhatdan
authored
2c1a2ab

Commits on Mar 6, 2019

Add new release to fix issues with udica
rhatdan
committed
5c98b56

Commits on Mar 8, 2019

Allow all container domains to have container file types entrypoint
rhatdan
committed
2521d0d

Commits on Mar 20, 2019

Allow containers to use fuse file systems.
rhatdan
committed
619db17

Commits on Mar 26, 2019

Allow container runtimes to create unlabeled keyrings
rhatdan
committed
acc6941

Commits on Mar 27, 2019

Add boolean to allow containers to use ceph file systems
rhatdan
committed
bf9e352

Commits on Mar 28, 2019

Allow container domains to create fifo_files on fusefs file systems
rhatdan
committed
53cdfc3
Allow init_t to manage container content files
rhatdan
committed
1e99f1d

Commits on Apr 1, 2019

Allow containers to manage fusefs sockets and named pipes
rhatdan
committed
e3ebc68

Commits on Apr 4, 2019

Allow containers to read/write sysctl_kernel_ns_last_pid_t
rhatdan
committed
da8c574

Commits on Apr 12, 2019

Add container_manage_config_files() interface
wrabcak
committed
ad5f630
Merge pull request #69 from wrabcak/master
wrabcak
authored
7ba191a
Merge branch 'master' of github.com:containers/container-selinux
rhatdan
committed
a6c9822

Commits on Apr 15, 2019

Allow iptables domains to append to container_file_t
rhatdan
committed
aa7b807

Commits on Apr 19, 2019

Fix typo in container_manage_config_files()
wrabcak
committed
82d4e20
Merge pull request #70 from wrabcak/master
wrabcak
authored
ec20b4a

Commits on Apr 20, 2019

Fix documentation on interface
rhatdan
committed
a0c3116

Commits on Apr 22, 2019

Fix labeling on overlay-layers and overlay-images
rhatdan
committed
9a53d6c

Commits on Apr 23, 2019

Allow spc_t to create unlabeled_t keyrings
rhatdan
committed
3b78187

Commits on May 3, 2019

Allow containers to read rpm cache files
rhatdan
committed
b0061dc

Commits on May 12, 2019

Allow all container domains to be entered from container_file_t
rhatdan
committed
1c24dcb

Commits on May 17, 2019

Add labels for /var/lib/containers/storage/volumes/*/*
rhatdan
committed
b275a1f

Commits on May 31, 2019

container.fc: label {var/srv,srv}/containers as container_file_t
mike-nguyen
committed
8422721

Commits on Jun 3, 2019

Merge pull request #72 from mike-nguyen/srv_containers
rhatdan
authored
07852ca
Create new version with labeling for silverblue
rhatdan
committed
7baad79

Commits on Jun 8, 2019

Add labeling for kubernetes pods
rhatdan
committed
6e069eb

Commits on Jun 11, 2019

Allow all unconfined domains to manage unlabeled keyrings
rhatdan
committed
fc7111d

Commits on Jun 14, 2019

Allow containers to manipulate Onload files.
rhatdan
committed
453b816

Commits on Jun 28, 2019

Allow containers to coonect to gssproxy stream sockets if added to container
rhatdan
committed
0aa6e7d

Commits on Jul 8, 2019

Allow containers to accept connections on all socket types
rhatdan
committed
db771da

Commits on Jul 9, 2019

Allow init_t to read container runtime files
rhatdan
committed
08282a8
SELinux policy documentation in README
ashley-cui
committed
b5217c7
Merge pull request #74 from ashley-cui/readme
rhatdan
authored
544d71f

Commits on Jul 18, 2019

Dontaudit attempts to setattr on devicenodes.
rhatdan
committed
9a75deb

Commits on Aug 8, 2019

Allow containers to use fusefs_t entrypoint
rhatdan
committed
b68cf19

Commits on Aug 9, 2019

We want to allow containers to do anything with the network
rhatdan
committed
4f7d6bb

Commits on Aug 19, 2019

Allow containers to setattr on their processes link files
rhatdan
committed
028ab00

Commits on Aug 21, 2019

Allow containers to execmod files on fusefs_t file systems
rhatdan
committed
fddfbbb

Commits on Sep 4, 2019

Tighten policy on container_runtime_t transitioning to svirt_sandbox_domains
rhatdan
committed
c5ef5ac

Commits on Sep 20, 2019

container.fc: label crun
giuseppe
committed
b62485a
Merge pull request #76 from giuseppe/add-crun
rhatdan
authored
2bc8648
Bump a new version
rhatdan
committed
bfde70a

Commits on Oct 11, 2019

Dontaudit attempts by containers to write systectls
rhatdan
committed
79bdcb5

Commits on Oct 24, 2019

Allow containers to use leaked pipes from user domains
rhatdan
committed
b383f07

Commits on Oct 27, 2019

move to 2.119.1-dev
rhatdan
committed
a9e5b46
Remove VERSION file
rhatdan
committed
2ecb2a8

Commits on Nov 6, 2019

Add container_runtime_domain attribute
rhatdan
committed
e544d77
Add role to container_runtime_domain interface
rhatdan
committed
6fb6dcf

Commits on Nov 14, 2019

Allow containers to listen on sctp_sockets
rhatdan
committed
1589288

Commits on Nov 19, 2019

New alias for container_share_t type
wrabcak
committed
a02c6f0
Merge pull request #82 from wrabcak/container_ro
rhatdan
authored
a233788

Commits on Nov 22, 2019

Make container_file_t a logging file
rhatdan
committed
67b024d
Merge branch 'master' of github.com:containers/container-selinux
rhatdan
committed
f69b9a4
Bump verion to v2.122.0
rhatdan
committed
4560dd4

Commits on Nov 25, 2019

Change container_ro_file_t type statement to typealias
zpytela
committed
cbe1e72
Merge pull request #84 from zpytela/fb-container-ro
rhatdan
authored
b5c9e8b
Bump version to trigger build
rhatdan
committed
661a904

Commits on Nov 28, 2019

Use priority 200 for uninstalling the container module BZ(1777740)
zpytela
committed
6ee4ce3

Commits on Nov 29, 2019

Merge pull request #85 from zpytela/fb-spec-macros
rhatdan
authored
0b25a4a

Commits on Dec 11, 2019

Allow systemd_logind_t to transition to container_runtime_t
rhatdan
committed
f958d0c

Commits on Feb 8, 2020

Add Code of Conduct
TomSweeneyRedHat
committed
132f939

Commits on Feb 10, 2020

Merge pull request #88 from TomSweeneyRedHat/coc
rhatdan
authored
5624558

Commits on Mar 20, 2020

Add policy for kata containers
rhatdan
committed
b321ea4

Commits on Mar 23, 2020

Commits on Mar 26, 2020

Add container_init_t types to container policy
rhatdan
committed
867a377

Commits on Mar 27, 2020

add missing rules for container_kvm_t
rhatdan
committed
6caf15d

Commits on Mar 29, 2020

Allpw containers to use sctp ports
rhatdan
committed
363646f
Drop some container interface from selinux-policy
rhatdan
committed
3a21d67
Re-add Drop some container interface from selinux-policy patch
rhatdan
committed
f00d1f4

Commits on Apr 6, 2020

Allow container domains to send dgram sockets to container runtime
rhatdan
committed
fd55ae0

Commits on Apr 9, 2020

Allow container domains to search through any directories
rhatdan
committed
9ce0dac

Commits on Apr 15, 2020

Allow container domains to send sigchld to container runtime
rhatdan
committed
448dfbf
Add support for running containers within containers
rhatdan
committed
0f3e098

Commits on May 28, 2020

Allow containers to manage fuse sockets and pipes
rhatdan
committed
ff26015

Commits on May 29, 2020

Allow container runtimes to launch unconfined_t processes
rhatdan
committed
0d99e89

Commits on Jun 11, 2020

Allow virt_domains to use container_file types
rhatdan
committed
441172a
allow container tools to transition to virtd_t
rhatdan
committed
6b721da

Commits on Jul 9, 2020

Allow containers to use fifo files handed to them by users
rhatdan
committed
9884317

Commits on Jul 18, 2020

Allow container domains to setfscreate
rhatdan
committed
8c26927

Commits on Jul 23, 2020

Allow cron jobs to run podman
rhatdan
committed
965c7fb

Commits on Jul 24, 2020

Allow uncontined domains to transition to container domains
rhatdan
committed
2750e78
Allow container entrypoints to uncontined domains
rhatdan
committed
fe6a25c

Commits on Aug 4, 2020

support containerd/cri
dweomer
committed
95decf9

Commits on Aug 5, 2020

Merge pull request #98 from dweomer/containerd
rhatdan
authored
ec6130c
Bump to 2.143.0
rhatdan
committed
e2d5a9e

Commits on Aug 12, 2020

Add support for kubernetes_file_t
rhatdan
committed
746ea7a

Commits on Aug 13, 2020

Add /usr/local/bin/docker.*
AkihiroSuda
committed
7fa4ae8
Merge pull request #102 from AkihiroSuda/add-usr-local-bin-docker
rhatdan
authored
5d929d4

Commits on Sep 10, 2020

#104 - Allow container_t to open existing tun/tap
Marcus Sorensen
committed
fc69960
Merge pull request #105 from mlsorensen/tuntap
rhatdan
authored
464e922

Commits on Oct 7, 2020

Add rules to allow confined containers to create hugetlbfs_t files
rhatdan
committed
2908536

Commits on Oct 12, 2020

Add allow rules for when unconfined domain disabled
rhatdan
committed
9fb1698

Commits on Oct 14, 2020

Allow container runtimes to mounton /proc
rhatdan
committed
3c361a2
Added Copyright Notice file
Durai G
committed
58192a0

Commits on Oct 15, 2020

Merge pull request #110 from dvattaka/bugfix/109-copyright-notice
rhatdan
authored
9b3b66f

Commits on Oct 22, 2020

Additional rules required for kvm containers
rhatdan
committed
e80cdf3
Add rules for kvm containers to use vfio_device
rhatdan
committed
0ef4703

Commits on Nov 3, 2020

KVM Container need to use tunnel sockets created by runtime.
rhatdan
committed
5d3c461

Commits on Nov 17, 2020

Allow container to relabel tun/tap device from container_runtime
Marcus Sorensen
committed
8003302

Commits on Dec 22, 2020

Allow containers to read nsfs file systems
rhatdan
committed
1677bc4

Commits on Dec 26, 2020

Allow container domains to use nfs if virt_use_nfs boolean is set
rhatdan
committed
8573f8d

Commits on Dec 30, 2020

Commits on Jan 5, 2021

Allow confined users to seind dbus messages to container_runtime
rhatdan
committed
667f0f3

Commits on Jan 15, 2021

Handle execmod for nfs, samba and cephfs_t shares
rhatdan
committed
75f193a

Commits on Jan 19, 2021

Original inclusion for container-selinux support in Ubuntu 20.04+
CHAaSM
committed
55af40e
Interfaces not found in upstream Selinux refpolicy
CHAaSM
committed
4003e20

Commits on Jan 22, 2021

Commits on Feb 2, 2021

Merge pull request #117 from smijolovic/selinux_ubuntu
rhatdan
authored
a5a4a8e
Allow init containers to send syslog messages
rhatdan
committed
10aba17
Merge pull request #118 from rhatdan/master
rhatdan
authored
f330e81

Commits on Feb 4, 2021

Commits on Feb 11, 2021

Add nfs remount support
rhatdan
committed
56e1f94
Merge pull request #121 from rhatdan/master
rhatdan
authored
eb6dad0
adjust container_filetrans_named_content requires
dweomer
committed
081c164

Commits on Feb 12, 2021

Merge pull request #122 from dweomer/filetrans-named-content-require-container-kvm-var-run-t
rhatdan
authored
aeb85c4

Commits on Feb 16, 2021

Drop use of "stub" interfaces
WOnder93
committed
e95f6a7
Merge pull request #123 from WOnder93/drop-stub-calls
rhatdan
authored
e78ac4f

Commits on Mar 22, 2021

Allow containers to write to /dev/rand, /dev/urand
rhatdan
committed
690076c
Merge pull request #124 from rhatdan/rand
rhatdan
authored
d89a599

Commits on Mar 30, 2021

Allow unconfined domains to talk to unlabled sockets
rhatdan
committed
9e769d3
Merge pull request #126 from rhatdan/master
rhatdan
authored
c9f0cb6

Commits on Apr 20, 2021

Add SECURITY.md
TomSweeneyRedHat
committed
450f56e
Merge pull request #127 from TomSweeneyRedHat/dev/tsweeney/sec
rhatdan
authored
5a60716

Commits on Apr 22, 2021

allow (most) binaries to live in sbin and bin directories
jsegitz
committed
bbe4f19
Merge pull request #128 from jsegitz/master
rhatdan
authored
7ffded0