[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     5555bf53167e28f78a0f7f80784ee5ea5999c434
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Fri Dec 31 19:20:49 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:12:42 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=5555bf53

container, docker: add initial support for docker

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/container.fc | 25 ++++++++++
 policy/modules/services/container.if | 96 ++++++++++++++++++++++++++++++++++++
 policy/modules/services/docker.fc    |  8 +++
 policy/modules/services/docker.if    | 69 ++++++++++++++++++++++++++
 policy/modules/services/docker.te    | 85 +++++++++++++++++++++++++++++++
 5 files changed, 283 insertions(+)

diff --git a/policy/modules/services/container.fc b/policy/modules/services/container.fc
index 9de5a68d..524ccedb 100644
--- a/policy/modules/services/container.fc
+++ b/policy/modules/services/container.fc
@@ -13,13 +13,24 @@ HOME_DIR/\.local/share/containers/storage/volumes/[^/]+/.*		gen_context(system_u
 /usr/bin/crun	--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 /usr/bin/runc	--	gen_context(system_u:object_r:container_engine_exec_t,s0)
 
+/usr/lib/systemd/system/docker.*	--	gen_context(system_u:object_r:container_unit_t,s0)
+/usr/lib/systemd/system/containerd.*	--	gen_context(system_u:object_r:container_unit_t,s0)
+
 /etc/containers(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
 /etc/cni(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
+/etc/docker(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
+/etc/containerd(/.*)?		gen_context(system_u:object_r:container_config_t,s0)
 
 /run/containers(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
 /run/libpod(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
 /run/runc(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
 
+/run/docker(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
+/run/docker\.pid	--	gen_context(system_u:object_r:container_runtime_t,s0)
+/run/docker\.sock	-s	gen_context(system_u:object_r:container_runtime_t,s0)
+/run/containerd(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
+/run/containerd/[^/]+/sandboxes/[^/]+/shm(/.*)?		gen_context(system_u:object_r:container_engine_tmpfs_t,s0)
+
 /run/user/%{USERID}/netns(/.*)?		gen_context(system_u:object_r:container_runtime_t,s0)
 
 /var/cache/containers(/.*)?		gen_context(system_u:object_r:container_engine_cache_t,s0)
@@ -42,5 +53,19 @@ HOME_DIR/\.local/share/containers/storage/volumes/[^/]+/.*		gen_context(system_u
 /var/lib/containers/storage/overlay2-images(/.*)?		gen_context(system_u:object_r:container_ro_file_t,s0)
 /var/lib/containers/storage/volumes/[^/]+/.*		gen_context(system_u:object_r:container_file_t,s0)
 
+/var/lib/docker(/.*)?		gen_context(system_u:object_r:container_var_lib_t,s0)
+/var/lib/docker/.*/config\.env	--	gen_context(system_u:object_r:container_ro_file_t,s0)
+/var/lib/docker/containers/.*/.*\.log	--	gen_context(system_u:object_r:container_log_t,s0)
+/var/lib/docker/containers/.*/hostname	--	gen_context(system_u:object_r:container_ro_file_t,s0)
+/var/lib/docker/containers/.*/hosts	--	gen_context(system_u:object_r:container_ro_file_t,s0)
+/var/lib/docker/init(/.*)?		gen_context(system_u:object_r:container_ro_file_t,s0)
+/var/lib/docker/overlay(/.*)?		gen_context(system_u:object_r:container_ro_file_t,s0)
+/var/lib/docker/overlay2(/.*)?		gen_context(system_u:object_r:container_ro_file_t,s0)
+/var/lib/docker/volumes/[^/]+/.*		gen_context(system_u:object_r:container_file_t,s0)
+
+/var/lib/containerd(/.*)?		gen_context(system_u:object_r:container_var_lib_t,s0)
+/var/lib/containerd/[^/]+/sandboxes(/.*)?		gen_context(system_u:object_r:container_ro_file_t,s0)
+/var/lib/containerd/[^/]+/snapshots(/.*)?		gen_context(system_u:object_r:container_ro_file_t,s0)
+
 /var/log/containers(/.*)?		gen_context(system_u:object_r:container_log_t,s0)
 /var/log/pods(/.*)?		gen_context(system_u:object_r:container_log_t,s0)

diff --git a/policy/modules/services/container.if b/policy/modules/services/container.if
index 1c1950c7..58e8c470 100644
--- a/policy/modules/services/container.if
+++ b/policy/modules/services/container.if
@@ -423,6 +423,27 @@ interface(`container_engine_dbus_chat',`
 	allow container_engine_domain $1:dbus send_msg;
 ')
 
+########################################
+## <summary>
+##	Allow the specified domain to be started
+##	by systemd socket activation using a
+##	named socket labeled the container
+##	runtime type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`container_runtime_named_socket_activation',`
+	gen_require(`
+		type container_runtime_t;
+	')
+
+	init_named_socket_activation($1, container_runtime_t)
+')
+
 ########################################
 ## <summary>
 ##	Allow the specified domain to manage
@@ -572,6 +593,28 @@ interface(`container_domtrans',`
 	allow $1 container_domain:process transition;
 ')
 
+########################################
+## <summary>
+##	Connect to a system container domain
+##	over a unix stream socket.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`container_stream_connect_system_containers',`
+	gen_require(`
+		attribute container_system_domain;
+		type container_runtime_t;
+	')
+
+	files_search_runtime($1)
+	stream_connect_pattern($1, container_runtime_t, container_runtime_t, container_system_domain)
+	allow $1 container_runtime_t:sock_file read_sock_file_perms;
+')
+
 ########################################
 ## <summary>
 ##	Connect to a container domain
@@ -591,6 +634,7 @@ interface(`container_stream_connect_all_containers',`
 
 	files_search_runtime($1)
 	stream_connect_pattern($1, container_runtime_t, container_runtime_t, container_domain)
+	allow $1 container_runtime_t:sock_file read_sock_file_perms;
 ')
 
 ########################################
@@ -650,6 +694,25 @@ interface(`container_mountpoint',`
 	typeattribute $1 container_mountpoint_type;
 ')
 
+########################################
+## <summary>
+##	Allow the specified domain to
+##	manage container config files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`container_manage_config_files',`
+	gen_require(`
+		type container_config_t;
+	')
+
+	manage_files_pattern($1, container_config_t, container_config_t)
+')
+
 ########################################
 ## <summary>
 ##	Allow the specified domain to
@@ -1166,6 +1229,39 @@ interface(`container_manage_var_lib_sock_files',`
 	manage_sock_files_pattern($1, container_var_lib_t, container_var_lib_t)
 ')
 
+########################################
+## <summary>
+##	Allow the specified domain to create
+##	objects in unlabeled directories with
+##	an automatic type transition to the
+##	container var lib type.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="object">
+##	<summary>
+##	The object class of the object being created.
+##	</summary>
+## </param>
+## <param name="name" optional="true">
+##	<summary>
+##	The name of the object being created.
+##	</summary>
+## </param>
+#
+interface(`container_unlabeled_var_lib_filetrans',`
+	gen_require(`
+		type container_var_lib_t;
+	')
+
+	# This access is to workaround an issue in Docker
+	# See: https://github.com/moby/moby/issues/43088
+	kernel_unlabeled_filetrans($1, container_var_lib_t, $2, $3)
+')
+
 ########################################
 ## <summary>
 ##	All of the rules required to

diff --git a/policy/modules/services/docker.fc b/policy/modules/services/docker.fc
new file mode 100644
index 00000000..577d148f
--- /dev/null
+++ b/policy/modules/services/docker.fc
@@ -0,0 +1,8 @@
+/usr/bin/docker	--	gen_context(system_u:object_r:dockerc_exec_t,s0)
+/usr/bin/dockerd	--	gen_context(system_u:object_r:dockerd_exec_t,s0)
+/usr/bin/docker-proxy	--	gen_context(system_u:object_r:dockerd_exec_t,s0)
+/usr/bin/containerd	--	gen_context(system_u:object_r:dockerd_exec_t,s0)
+/usr/bin/containerd-shim	--	gen_context(system_u:object_r:dockerd_exec_t,s0)
+/usr/bin/containerd-shim-runc-v1	--	gen_context(system_u:object_r:dockerd_exec_t,s0)
+/usr/bin/containerd-shim-runc-v2	--	gen_context(system_u:object_r:dockerd_exec_t,s0)
+/usr/bin/containerd-stress	--	gen_context(system_u:object_r:dockerd_exec_t,s0)

diff --git a/policy/modules/services/docker.if b/policy/modules/services/docker.if
new file mode 100644
index 00000000..28965cdb
--- /dev/null
+++ b/policy/modules/services/docker.if
@@ -0,0 +1,69 @@
+## <summary>Policy for docker</summary>
+
+########################################
+## <summary>
+##	Execute docker CLI in the docker CLI domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+#
+interface(`docker_domtrans_cli',`
+	gen_require(`
+		type dockerc_t, dockerc_exec_t;
+	')
+
+	corecmd_search_bin($1)
+	domtrans_pattern($1, dockerc_exec_t, dockerc_t)
+')
+
+########################################
+## <summary>
+##	Execute docker CLI in the docker CLI
+##	domain, and allow the specified role
+##	the docker CLI domain.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed to transition.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	The role to be allowed the docker domain.
+##	</summary>
+## </param>
+#
+interface(`docker_run_cli',`
+	gen_require(`
+		type dockerc_t;
+	')
+
+	role $2 types dockerc_t;
+
+	docker_domtrans_cli($1)
+')
+
+########################################
+## <summary>
+##	All of the rules required to
+##	administrate a docker
+##	environment.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+## <param name="role">
+##	<summary>
+##	Role allowed access.
+##	</summary>
+## </param>
+## <rolecap/>
+#
+interface(`docker_admin',`
+	docker_run_cli($1, $2)
+')

diff --git a/policy/modules/services/docker.te b/policy/modules/services/docker.te
new file mode 100644
index 00000000..27278127
--- /dev/null
+++ b/policy/modules/services/docker.te
@@ -0,0 +1,85 @@
+policy_module(docker)
+
+########################################
+#
+# Declarations
+#
+
+container_engine_domain_template(dockerd)
+container_system_engine(dockerd_t)
+type dockerd_exec_t;
+container_engine_executable_file(dockerd_exec_t)
+application_domain(dockerd_t, dockerd_exec_t)
+ifdef(`enable_mls',`
+	init_ranged_daemon_domain(dockerd_t, dockerd_exec_t, s0 - mls_systemhigh)
+')
+mls_trusted_object(dockerd_t)
+
+type dockerc_t;
+type dockerc_exec_t;
+container_engine_executable_file(dockerc_t)
+application_domain(dockerc_t, dockerc_exec_t)
+
+########################################
+#
+# Docker daemon local policy
+#
+
+allow dockerd_t self:netlink_netfilter_socket create_socket_perms;
+allow dockerd_t self:netlink_xfrm_socket create_socket_perms;
+
+init_write_runtime_socket(dockerd_t)
+container_runtime_named_socket_activation(dockerd_t)
+
+# docker fails to start if /proc/kallsyms is unreadable,
+# but only when btrfs support is disabled
+files_read_kernel_symbol_table(dockerd_t)
+files_dontaudit_write_usr_dirs(dockerd_t)
+
+kernel_relabelfrom_unlabeled_dirs(dockerd_t)
+# docker wants to load binfmt_misc
+kernel_request_load_module(dockerd_t)
+kernel_dontaudit_search_fs_sysctls(dockerd_t)
+
+logging_send_syslog_msg(dockerd_t)
+
+container_stream_connect_system_containers(dockerd_t)
+
+# docker manages key.json in /etc/docker
+container_manage_config_files(dockerd_t)
+
+# In btrfs mode, docker creates subvolumes which are unlabeled
+# in /var/lib/docker/btrfs/subvolumes. The files inside will
+# become labeled with a file transition, but the subvolume
+# root will always be unlabeled.
+container_unlabeled_var_lib_filetrans(dockerd_t, dir)
+
+ifdef(`init_systemd',`
+	init_dbus_chat(dockerd_t)
+	init_get_generic_units_status(dockerd_t)
+	init_start_generic_units(dockerd_t)
+	init_start_system(dockerd_t)
+	init_stop_system(dockerd_t)
+')
+
+########################################
+#
+# Docker CLI local policy
+#
+
+allow dockerc_t self:process { getsched signal };
+allow dockerc_t self:fifo_file rw_fifo_file_perms;
+
+allow dockerc_t dockerd_t:unix_stream_socket connectto;
+
+corecmd_dontaudit_search_bin(dockerc_t)
+
+domain_use_interactive_fds(dockerc_t)
+
+auth_use_nsswitch(dockerc_t)
+
+miscfiles_read_localization(dockerc_t)
+
+userdom_use_user_ptys(dockerc_t)
+
+container_stream_connect_system_containers(dockerc_t)