mirrors/flatcar-scripts
1
0
Fork 0
mirror of https://github.com/flatcar/scripts.git synced 2025-08-17 18:06:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

sec-policy/selinux-base-policy: add capability to unlabeled_t

Browse Source 
with this patch, we allow `unlabeled_t` to associate to tmpfs
filesystem.
It aims to solve the AVC we have with `torcx` with the
`torcx-generator`:
```
Nov 15 09:45:43 localhost audit[688]: AVC avc: denied { associate } for pid=688 comm="torcx-generator" name="docker" dev="tmpfs" ino=2 scontext=system_u:object_r:unlabeled_t:s0 tcontext=system_u:object_r:tmpfs_t:s0 tclass=filesystem permissive=0
```

It has been not been caught earlier because it occurs
when the system boots with `SELinux` in `enforcing` mode.

This denial was preventing torcx to finish correctly its setup and so
Docker was not able to start.

Signed-off-by: Mathieu Tortuyaux <mtortuyaux@microsoft.com>
This commit is contained in:
Mathieu Tortuyaux 2021-11-17 16:45:58 +01:00
parent e7e8b822ac
commit 5c25c3835c
2 changed files with 15 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/files/unlabeled.patch vendored Normal file
View File

@ -0,0 +1,11 @@
index 7c60eda2c..736187b7a 100644
--- refpolicy/policy/modules/kernel/kernel.te
+++ refpolicy/policy/modules/kernel/kernel.te
@@ -191,6 +191,7 @@ genfscon proc /sys/dev gen_context(system_u:object_r:sysctl_dev_t,s0)
type unlabeled_t;
kernel_rootfs_mountpoint(unlabeled_t)
fs_associate(unlabeled_t)
+fs_associate_tmpfs(unlabeled_t)
sid file gen_context(system_u:object_r:unlabeled_t,s0)
sid unlabeled gen_context(system_u:object_r:unlabeled_t,mls_systemhigh)
neverallow * unlabeled_t:file entrypoint;

4
sdk_container/src/third_party/coreos-overlay/sec-policy/selinux-base-policy/selinux-base-policy-2.20200818-r2.ebuild vendored
View File

@ -39,6 +39,10 @@ PATCHES=(
"${FILESDIR}/init.patch"
"${FILESDIR}/locallogin.patch"
"${FILESDIR}/logging.patch"
# this patch is required to prevent `torcx-generator`
# to fail if SELinux is enforced in early boot.
# It can be removed once we drop torcx support.
"${FILESDIR}/unlabeled.patch"
)
# Code entirely copied from selinux-eclass (cannot inherit due to dependency on