-
Notifications
You must be signed in to change notification settings - Fork 50
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #917 from flatcar/tormath1/selinux-policy-update
selinux: update
- Loading branch information
Showing
93 changed files
with
607 additions
and
1,535 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,11 @@ | ||
| - libselinux ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - libsepol ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - semodule-utils ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - policycoreutils ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - libsemanage ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - checkpolicy ([3.5](https://github.com/SELinuxProject/selinux/releases/tag/3.5)) | ||
| - selinux-base ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) | ||
| - selinux-base-policy ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) | ||
| - selinux-container ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) | ||
| - selinux-sssd ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) | ||
| - selinux-unconfined ([2.20221101](https://github.com/SELinuxProject/refpolicy/releases/tag/RELEASE_2_20221101)) |
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
2 changes: 2 additions & 0 deletions
2
sdk_container/src/third_party/coreos-overlay/coreos/config/env/sec-policy/selinux-base
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,2 @@ | ||
| PKG_INSTALL_MASK+=" /etc/selinux/config" | ||
| INSTALL_MASK+=" /etc/selinux/config" |
4 changes: 2 additions & 2 deletions
4
...licy/selinux-base-policy/files/init.patch → ...sec-policy/selinux-base-policy/init.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
6 changes: 3 additions & 3 deletions
6
...elinux-base-policy/files/locallogin.patch → ...licy/selinux-base-policy/locallogin.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
14 changes: 7 additions & 7 deletions
14
...y/selinux-base-policy/files/logging.patch → ...-policy/selinux-base-policy/logging.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,18 @@ | ||
| diff --git a/policy/modules/system/logging.te b/policy/modules/system/logging.te | ||
| index 7d713540d..d6cbc654d 100644 | ||
| --- refpolicy/policy/modules/system/logging.te | ||
| +++ refpolicy/policy/modules/system/logging.te | ||
| @@ -516,11 +516,13 @@ userdom_dontaudit_use_unpriv_user_fds(syslogd_t) | ||
| userdom_dontaudit_search_user_home_dirs(syslogd_t) | ||
| index abd61e6bd..fb5d69366 100644 | ||
| --- a/refpolicy/policy/modules/system/logging.te | ||
| +++ b/refpolicy/policy/modules/system/logging.te | ||
| @@ -525,11 +525,13 @@ userdom_dontaudit_search_user_home_dirs(syslogd_t) | ||
|
|
||
| ifdef(`init_systemd',` | ||
| + require { type kernel_t; } | ||
| # for systemd-journal | ||
| + require { type kernel_t; } | ||
| allow syslogd_t self:capability audit_control; | ||
| allow syslogd_t self:netlink_audit_socket connected_socket_perms; | ||
| allow syslogd_t self:capability2 audit_read; | ||
| allow syslogd_t self:capability { chown setgid setuid sys_ptrace }; | ||
| allow syslogd_t self:netlink_audit_socket { getattr getopt read setopt write nlmsg_write }; | ||
| + allow syslogd_t kernel_t:netlink_audit_socket getattr; | ||
| + allow syslogd_t kernel_t:netlink_audit_socket getattr; | ||
|
|
||
| # remove /run/log/journal when switching to permanent storage | ||
| allow syslogd_t var_log_t:dir rmdir; |
10 changes: 5 additions & 5 deletions
10
...licy/selinux-base-policy/files/ping.patch → ...sec-policy/selinux-base-policy/ping.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,19 +1,19 @@ | ||
| diff -u -r refpolicy/policy/modules/admin/netutils.te refpolicy/policy/modules/admin/netutils.te | ||
| --- refpolicy/policy/modules/admin/netutils.te 2022-01-12 14:28:26.850809330 -0000 | ||
| +++ refpolicy/policy/modules/admin/netutils.te 2022-01-12 14:29:50.323880882 -0000 | ||
| --- a/refpolicy/policy/modules/admin/netutils.te 2022-01-12 14:28:26.850809330 -0000 | ||
| +++ b/refpolicy/policy/modules/admin/netutils.te 2022-01-12 14:29:50.323880882 -0000 | ||
| @@ -117,6 +117,7 @@ | ||
| corenet_raw_sendrecv_generic_node(ping_t) | ||
| corenet_tcp_sendrecv_generic_node(ping_t) | ||
| corenet_raw_bind_generic_node(ping_t) | ||
| +corenet_icmp_bind_generic_node(ping_t) | ||
|
|
||
| dev_read_urand(ping_t) | ||
|
|
||
| @@ -189,6 +190,7 @@ | ||
| corenet_tcp_connect_all_ports(traceroute_t) | ||
| corenet_sendrecv_all_client_packets(traceroute_t) | ||
| corenet_sendrecv_traceroute_server_packets(traceroute_t) | ||
| +corenet_icmp_bind_generic_node(traceroute_t) | ||
|
|
||
| dev_read_rand(traceroute_t) | ||
| dev_read_urand(traceroute_t) |
16 changes: 16 additions & 0 deletions
16
...ches/sec-policy/selinux-base/0001-policy-modules-kernel-all-more-actions-for-kernel.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| diff --git refpolicy/policy/modules/kernel/kernel.te refpolicy/policy/modules/kernel/kernel.te | ||
| index 56dbd5af5..b5cf0e3c0 100644 | ||
| --- a/refpolicy/policy/modules/kernel/kernel.te | ||
| +++ b/refpolicy/policy/modules/kernel/kernel.te | ||
| @@ -363,6 +363,11 @@ files_list_home(kernel_t) | ||
| files_read_usr_files(kernel_t) | ||
|
|
||
| mcs_process_set_categories(kernel_t) | ||
| +mcs_killall(kernel_t) | ||
| +mcs_file_read_all(kernel_t) | ||
| +mcs_file_write_all(kernel_t) | ||
| +mcs_ptrace_all(kernel_t) | ||
| +allow kernel_t self:user_namespace create; | ||
|
|
||
| mls_process_read_all_levels(kernel_t) | ||
| mls_process_write_all_levels(kernel_t) |
44 changes: 44 additions & 0 deletions
44
...hird_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-base/files-relabel.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| diff --git a/policy/modules/kernel/files.if b/policy/modules/kernel/files.if | ||
| index 495cbe2f4..a5605f866 100644 | ||
| --- a/refpolicy/policy/modules/kernel/files.if | ||
| +++ b/refpolicy/policy/modules/kernel/files.if | ||
| @@ -7892,3 +7892,39 @@ interface(`files_unconfined',` | ||
|
|
||
| typeattribute $1 files_unconfined_type; | ||
| ') | ||
| + | ||
| +######################################## | ||
| +## <summary> | ||
| +## Relabel all files on the filesystem, except | ||
| +## policy_config_t and exceptions. | ||
| +## </summary> | ||
| +## <param name="domain"> | ||
| +## <summary> | ||
| +## Domain allowed access. | ||
| +## </summary> | ||
| +## </param> | ||
| +## <param name="exception_types" optional="true"> | ||
| +## <summary> | ||
| +## The types to be excluded. Each type or attribute | ||
| +## must be negated by the caller. | ||
| +## </summary> | ||
| +## </param> | ||
| +## <rolecap/> | ||
| +# | ||
| +interface(`files_relabel_all_non_policy_files',` | ||
| + gen_require(` | ||
| + attribute file_type; | ||
| + type policy_config_t; | ||
| + ') | ||
| + | ||
| + allow $1 { file_type -policy_config_t $2 }:dir list_dir_perms; | ||
| + relabel_dirs_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabel_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabel_lnk_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabel_fifo_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabel_sock_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + # this is only relabelfrom since there should be no | ||
| + # device nodes with file types. | ||
| + relabelfrom_blk_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| + relabelfrom_chr_files_pattern($1, { file_type -policy_config_t $2 }, { file_type -policy_config_t $2 }) | ||
| +') |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
77 changes: 77 additions & 0 deletions
77
...ird_party/coreos-overlay/coreos/user-patches/sec-policy/selinux-container/container.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| diff --git a/policy/modules/services/container.fc b/policy/modules/services/container.fc | ||
| index 056aa6023..e4bcada03 100644 | ||
| --- a/refpolicy/policy/modules/services/container.fc | ||
| +++ b/refpolicy/policy/modules/services/container.fc | ||
| @@ -113,3 +113,5 @@ HOME_DIR/\.docker(/.*)? gen_context(system_u:object_r:container_conf_home_t,s0) | ||
| /var/log/kube-controller-manager(/.*)? gen_context(system_u:object_r:container_log_t,s0) | ||
| /var/log/kube-proxy(/.*)? gen_context(system_u:object_r:container_log_t,s0) | ||
| /var/log/kube-scheduler(/.*)? gen_context(system_u:object_r:container_log_t,s0) | ||
| + | ||
| +/usr/share/containerd(/.*)? gen_context(system_u:object_r:container_config_t,s0) | ||
| diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te | ||
| index 5de421fc3..4a6c2760e 100644 | ||
| --- a/refpolicy/policy/modules/services/container.te | ||
| +++ b/refpolicy/policy/modules/services/container.te | ||
| @@ -1007,3 +1007,62 @@ optional_policy(` | ||
| unconfined_domain_noaudit(spc_user_t) | ||
| domain_ptrace_all_domains(spc_user_t) | ||
| ') | ||
| + | ||
| +allow container_domain self:socket_class_set { accept ioctl read getattr lock write append getopt setopt }; | ||
| +allow container_domain init_t:unix_stream_socket { accept ioctl read getattr lock write append getopt shutdown }; | ||
| + | ||
| +# required for sharing /run for the etcd-wrapper | ||
| +files_mounton_runtime_dirs(container_engine_domain) | ||
| + | ||
| +# this is a hack while the system is not labelled. we need to authorize transition from kernel_t | ||
| +require { | ||
| + type kernel_t; | ||
| + type tmpfs_t; | ||
| + type var_lib_t; | ||
| + type unconfined_t; | ||
| +} | ||
| +allow kernel_t container_t:process transition; | ||
| +allow initrc_t container_t:process transition; | ||
| +allow kernel_t container_t:process2 nnp_transition; | ||
| +allow kernel_t unconfined_t:process transition; | ||
| +fs_manage_tmpfs_chr_files(container_t) | ||
| +fs_manage_tmpfs_dirs(container_t) | ||
| +fs_manage_tmpfs_files(container_t) | ||
| +fs_manage_tmpfs_sockets(container_t) | ||
| +fs_manage_tmpfs_symlinks(container_t) | ||
| +fs_remount_tmpfs(container_t) | ||
| +kernel_read_messages(container_t) | ||
| +kernel_sigchld(container_t) | ||
| +kernel_use_fds(container_t) | ||
| +allow container_t self:process getcap; | ||
| +files_read_var_lib_files(container_t) | ||
| +files_read_var_lib_symlinks(container_t) | ||
| +term_use_generic_ptys(container_t) | ||
| +term_setattr_generic_ptys(container_t) | ||
| +allow container_t tmpfs_t:chr_file { read write open }; | ||
| +allow container_t container_file_t:chr_file { manage_file_perms }; | ||
| +allow container_t self:capability sys_chroot; | ||
| +allow container_t self:process getpgid; | ||
| +allow container_t container_file_t:file { entrypoint mounton }; | ||
| +allow container_t var_lib_t:file { entrypoint execute execute_no_trans }; | ||
| +allow container_t kernel_t:fifo_file { getattr ioctl read write open append }; | ||
| +allow container_t initrc_t:fifo_file { getattr ioctl read write open append }; | ||
| +filetrans_pattern(kernel_t, etc_t, container_file_t, dir, "cni"); | ||
| + | ||
| +# this is required by flanneld | ||
| +allow container_t kernel_t:system { module_request }; | ||
| + | ||
| +# required by flanneld to write into /run/flannel/subnet.env | ||
| +filetrans_pattern(kernel_t, var_run_t, container_file_t, dir, "flannel"); | ||
| + | ||
| +# required for cilium | ||
| +allow kernel_t spc_t:process transition; | ||
| +# required for cilium, can be upstreamed | ||
| +# Jun 20 08:01:43 localhost audit[3480]: AVC avc: denied { open } for pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1 | ||
| +# Jun 20 08:01:43 localhost audit[3480]: AVC avc: denied { kernel } for pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1 | ||
| +# Jun 20 08:01:43 localhost audit[3480]: AVC avc: denied { cpu } for pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1 | ||
| +# Jun 20 08:01:43 localhost audit[3480]: AVC avc: denied { read } for pid=3480 comm="cilium-agent" scontext=system_u:system_r:spc_t:s0 tcontext=system_u:system_r:spc_t:s0 tclass=perf_event permissive=1 | ||
| +allow spc_t self:perf_event { open cpu kernel read }; | ||
| +# required for using cilium cgroup v1 | ||
| +allow kernel_t self:perf_event { open cpu kernel read }; | ||
| +allow unconfined_t container_file_t:file { entrypoint }; |
4 changes: 0 additions & 4 deletions
4
sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/Manifest
This file was deleted.
Oops, something went wrong.
22 changes: 0 additions & 22 deletions
22
sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/sshd.patch
This file was deleted.
Oops, something went wrong.
11 changes: 0 additions & 11 deletions
11
...ainer/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/unlabeled.patch
This file was deleted.
Oops, something went wrong.
4 changes: 0 additions & 4 deletions
4
sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base/Manifest
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.