"Fossies" - the Fresh Open Source Software Archive

Member "lxc-4.0.11/config/selinux/lxc.te" (19 Oct 2021, 2869 Bytes) of package /linux/misc/lxc-4.0.11.tar.gz:


As a special service "Fossies" has tried to format the requested text file into HTML format (style: standard) with prefixed line numbers. Alternatively you can here view or download the uninterpreted source code file.

    1 #
    2 # SELinux policy for LXC for RHEL/CentOS/Oracle 6.5.
    3 # It attempts to restrict the container to the same amount of access
    4 # as an unprivileged user. To build and insert this policy module:
    5 #
    6 # make -f /usr/share/selinux/devel/Makefile lxc.pp
    7 # semodule -i lxc.pp
    8 #
    9 # In your container's lxc config:
   10 #   lxc.selinux.context = system_u:system_r:lxc_t:s0:c62,c86,c150,c228
   11 #
   12 # Ensure your container's rootfs files are labeled:
   13 #   chcon -R system_u:object_r:lxc_file_t:s0:c62,c86,c150,c228 /path/to/rootfs
   14 #
   15 # To keep containers separated from each other, you should vary the MCS
   16 # portion of the contexts above to be a unique set of values for each
   17 # container, each MCS compartment can be a number from 0-1023.
   18 #
   19 
   20 policy_module(lxc,0.35)
   21 
   22 userdom_unpriv_user_template(lxc)
   23 
   24 type lxc_file_t;
   25 files_type(lxc_file_t);
   26 role system_r types { lxc_t lxc_file_t };
   27 
   28 gen_require(`
   29 	type devpts_t;
   30 	type proc_t;
   31 	type ssh_port_t;
   32 	type sysctl_kernel_t;
   33 	type sysctl_modprobe_t;
   34 	type sysctl_net_t;
   35 	type tmpfs_t;
   36 	type unconfined_t;
   37 	class filesystem { relabelfrom unmount };
   38 	class tcp_socket name_bind;
   39 	class udp_socket name_bind;
   40 ');
   41 
   42 # So lxc can transition to lxc_t on exec
   43 allow unconfined_t lxc_t:process transition;
   44 can_exec(lxc_t, lxc_file_t)
   45 
   46 # So lxc can dyntransition to lxc_t for attach executing a function
   47 allow unconfined_t lxc_t:process dyntransition;
   48 
   49 # So lxc-start can relabel the pty allocated for the console
   50 allow lxc_file_t devpts_t:filesystem associate;
   51 
   52 # So container can mount /dev/shm and relabel it
   53 allow lxc_t tmpfs_t:filesystem relabelfrom;
   54 
   55 # Allow all access to an lxc_file_t type; devices can be restricted
   56 # with the device cgroup, they are not here
   57 allow lxc_t lxc_file_t:file *;
   58 allow lxc_t lxc_file_t:lnk_file *;
   59 allow lxc_t lxc_file_t:chr_file *;
   60 allow lxc_t lxc_file_t:blk_file *;
   61 allow lxc_t lxc_file_t:sock_file *;
   62 allow lxc_t lxc_file_t:fifo_file *;
   63 allow lxc_t lxc_file_t:socket *;
   64 allow lxc_t lxc_file_t:dir *;
   65 allow lxc_t lxc_file_t:filesystem unmount;
   66 
   67 fs_unmount_all_fs(lxc_t)
   68 
   69 allow lxc_t proc_t:dir mounton;
   70 allow lxc_t proc_t:filesystem mount;
   71 
   72 allow lxc_t tmpfs_t:filesystem mount;
   73 allow lxc_t self:capability { dac_override dac_read_search fsetid ipc_lock net_admin net_bind_service net_broadcast net_raw sys_admin sys_boot sys_tty_config };
   74 
   75 allow lxc_t sysctl_net_t:file write;
   76 allow lxc_t ssh_port_t:tcp_socket name_bind;
   77 
   78 corenet_tcp_connect_all_ports(lxc_t)
   79 corenet_tcp_bind_all_ports(lxc_t)
   80 corenet_udp_bind_all_ports(lxc_t)
   81 
   82 # Needed for ifup/ip/dhcp
   83 allow lxc_t self:packet_socket create_socket_perms;
   84 allow lxc_t self:rawip_socket create_socket_perms;
   85 allow lxc_t self:netlink_route_socket create_netlink_socket_perms;
   86 
   87 # Needed to set label that the keyring will be created with
   88 allow lxc_t self:process { setkeycreate };
   89 
   90 dontaudit lxc_t sysctl_kernel_t:file write;
   91 dontaudit lxc_t sysctl_modprobe_t:file write;