[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/

["Jason Zaman" <perfinion@gentoo.org>]

commit:     7312b188899d6ea718be9c885eb4a6f15ccd8aa7
Author:     Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Thu Dec 23 15:55:53 2021 +0000
Commit:     Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:12:42 2022 +0000
URL:        https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=7312b188

container: add policy for privileged containers

Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>

 policy/modules/services/container.te | 86 ++++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)

diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te
index 7ab2765e..483cdcb2 100644
--- a/policy/modules/services/container.te
+++ b/policy/modules/services/container.te
@@ -22,6 +22,9 @@ attribute container_engine_user_domain;
 # containers which require network access
 attribute container_net_domain;
 
+# containers considered privileged
+attribute privileged_container_domain;
+
 attribute container_engine_exec_type;
 
 attribute container_mountpoint_type;
@@ -43,6 +46,13 @@ ifdef(`enable_mls',`
 ')
 mls_trusted_object(container_engine_t)
 
+type spc_t, container_domain, container_net_domain, container_system_domain, privileged_container_domain;
+domain_type(spc_t)
+role system_r types spc_t;
+
+type spc_user_t, container_domain, container_net_domain, container_user_domain, privileged_container_domain;
+domain_type(spc_user_t)
+
 type container_unit_t;
 init_unit_file(container_unit_t)
 
@@ -562,3 +572,79 @@ filetrans_pattern(container_engine_user_domain, container_data_home_t, container
 filetrans_pattern(container_engine_user_domain, container_data_home_t, container_ro_file_t, dir, "overlay2-images")
 filetrans_pattern(container_engine_user_domain, container_data_home_t, container_ro_file_t, dir, "overlay2-layers")
 filetrans_pattern(container_engine_user_domain, container_data_home_t, container_file_t, dir, "volumes")
+
+########################################
+#
+# Common privileged container local policy
+#
+
+allow privileged_container_domain container_file_t:file entrypoint;
+allow privileged_container_domain container_ro_file_t:file entrypoint;
+allow privileged_container_domain container_var_lib_t:file entrypoint;
+
+optional_policy(`
+	systemd_dbus_chat_machined(privileged_container_domain)
+	systemd_dbus_chat_logind(privileged_container_domain)
+')
+
+########################################
+#
+# spc local policy
+#
+# spc_t is the default type for containers created
+# with the --privileged (or similar) argument
+#
+
+# Containers run from an engine with the --privileged argument are not
+# restricted by the engine. One of these restrictions is a manual
+# transition to the default context for containers, usually container_t.
+# Instead of performing a manual transition when creating a restricted
+# container (default), we do an automatic transition to spc_t when
+# restrictions are disabled.
+domtrans_pattern(container_engine_system_domain, container_file_t, spc_t)
+domtrans_pattern(container_engine_system_domain, container_ro_file_t, spc_t)
+domtrans_pattern(container_engine_system_domain, container_var_lib_t, spc_t)
+
+allow container_engine_system_domain spc_t:process { setsched signal_perms };
+
+allow spc_t container_engine_system_domain:fifo_file rw_fifo_file_perms;
+
+init_dbus_chat(spc_t)
+
+optional_policy(`
+	dbus_system_bus_client(spc_t)
+	dbus_all_session_bus_client(spc_t)
+')
+
+optional_policy(`
+# If unconfined domains are enabled, spc is also unconfined
+	unconfined_domain_noaudit(spc_t)
+	domain_ptrace_all_domains(spc_t)
+')
+
+########################################
+#
+# spc user local policy
+#
+
+# Similar to above, automatically transition to spc_user_t when a
+# container engine runs a container with the --privileged argument
+domtrans_pattern(container_engine_user_domain, container_file_t, spc_user_t)
+domtrans_pattern(container_engine_user_domain, container_ro_file_t, spc_user_t)
+domtrans_pattern(container_engine_user_domain, container_var_lib_t, spc_user_t)
+fs_fusefs_domtrans(container_engine_user_domain, spc_user_t)
+
+allow container_engine_user_domain spc_user_t:process { setsched signal_perms };
+
+allow spc_user_t container_engine_user_domain:fifo_file rw_fifo_file_perms;
+
+optional_policy(`
+       dbus_system_bus_client(spc_user_t)
+       dbus_all_session_bus_client(spc_user_t)
+')
+
+optional_policy(`
+       # If unconfined domains are enabled, spc is also unconfined
+       unconfined_domain_noaudit(spc_user_t)
+       domain_ptrace_all_domains(spc_user_t)
+')