Moved all the missing interfaces to the container-selinux container.if file to test the use of the standard ref policy in Ubuntu. There is one conflict between the fedora dbus_system_bus_client interface client, so to test I commented out the default policy interface for this in dbus.if. There's a lot missing in the default reference policy raising a lot of caution about why fedora/RHEL is so far removed from the open standard ref policy. We have the full list for injection into the standard interfaces we can provide to add to upstream...once we figure out what's missing below.

In addition, mmap_file_perms is not in any of the default refpolicy .spt....so this was added to container.te:
define(mmap_file_perms',{ getattr open map read execute ioctl }')

I am able to build the module - but can not install it. semodule -i complains about a number of type aliases and attributes (cil errors):

Failed to resolve typealiasactual statement at /var/lib/selinux/default/tmp/modules/400/container/cil:6
cil:
(typealiasactual docker_share_t container_ro_file_t)
from the te file:
typealias container_ro_file_t alias { container_share_t docker_share_t };

Failed to resolve typeattributeset statement at /var/lib/selinux/default/tmp/modules/400/container/cil:48
cil:
(typeattributeset container_domain (spc_t container_t container_userns_t container_logreader_t container_kvm_t container_init_t container_engine_t ))
from the te file:
typeattribute container_t container_domain, container_net_domain, container_user_domain;

Failed to resolve typeattributeset statement at /var/lib/selinux/default/tmp/modules/400/container/cil:162
cil:
(typeattributeset file_type (container_var_lib_t container_ro_file_t container_runtime_exec_t container_auth_exec_t spc_var_run_t kubernetes_file_t container_home_t container_config_t container_lock_t container_log_t container_runtime_tmp_t container_runtime_tmpfs_t container_var_run_t container_plugin_var_run_t container_unit_file_t bin_t shell_exec_t container_file_t container_kvm_var_run_t ))

Cil debugging is quite painful and makes the mappings extremely difficult to resolve.

build with standard refpolicy #113

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions