From 5031b142649d45e16c85248c773fe4641a7e9a2a Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 9 Mar 2021 20:47:37 +0100 Subject: [PATCH 1/5] Revert "Add %check section to run basic tests during rpm build process" The check is not necessary since it's part of the CI and brings needless dependencies. This reverts commits fa6f003ec4023f3ffac7eb7d01e1e79fccf51a04 and 4dc4b32e96018a0323a45a279a00f6e42d5ff0f7. --- udica.spec | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/udica.spec b/udica.spec index eea4109..ebd5ce2 100644 --- a/udica.spec +++ b/udica.spec @@ -6,9 +6,8 @@ Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica -BuildRequires: make %if 0%{?fedora} || 0%{?rhel} > 7 -BuildRequires: python3 python3-devel python3-setuptools python3-pyflakes black +BuildRequires: python3 python3-devel python3-setuptools Requires: python3 python3-libsemanage python3-libselinux %else BuildRequires: python2 python2-devel python2-setuptools @@ -41,9 +40,6 @@ install --directory %%{buildroot}%{_datadir}/udica/templates install --directory %{buildroot}%{_mandir}/man8 install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 -%check -make test - %files %{_mandir}/man8/udica.8* %{_bindir}/udica From b0ad976319f4397b2d3deca2605e6226bdf78256 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 16 Mar 2021 16:06:06 +0100 Subject: [PATCH 2/5] * Tue Mar 16 2021 Vit Mojzis - 0.2.4-4 - Remove %check section --- udica.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/udica.spec b/udica.spec index ebd5ce2..22b9d16 100644 --- a/udica.spec +++ b/udica.spec @@ -1,7 +1,7 @@ Summary: A tool for generating SELinux security policies for containers Name: udica Version: 0.2.4 -Release: 3%{?dist} +Release: 4%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz License: GPLv3+ BuildArch: noarch @@ -60,6 +60,9 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Tue Mar 16 2021 Vit Mojzis - 0.2.4-4 +- Remove %check section + * Wed Jan 27 2021 Fedora Release Engineering - 0.2.4-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild From 8d4d9f3eaae1a7b0dade111be886fc9b2b69fcb6 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 25 Aug 2021 13:19:03 +0200 Subject: [PATCH 3/5] udica-0.2.5-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.5 - Replace capability dictionary with str.lower() - Enable udica to generate policies with fifo class - Sort container inspect data before processing - Update templates to work properly with new cil parser --- .gitignore | 1 + ...-to-work-properly-with-new-cil-parse.patch | 381 ++++++++++++++++++ sources | 2 +- udica.spec | 12 +- 4 files changed, 393 insertions(+), 3 deletions(-) create mode 100644 0001-Update-templates-to-work-properly-with-new-cil-parse.patch diff --git a/.gitignore b/.gitignore index e27bbaa..42c7c98 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /v0.2.2.tar.gz /v0.2.3.tar.gz /v0.2.4.tar.gz +/v0.2.5.tar.gz diff --git a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch new file mode 100644 index 0000000..5d1ab67 --- /dev/null +++ b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch @@ -0,0 +1,381 @@ +From 09bf6b339f1219769ada2c108c429013af19ceb5 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 26 Aug 2021 17:48:45 +0200 +Subject: [PATCH] Update templates to work properly with new cil parser + +Cil parser was recently updated to reject the following: +(block template1 (type t) ) +(block template2 (blockinherit template1)) +(block b (blockinherit template1) (blockinherit template2)) + +Re-declaration of type t +Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1 +Failed to copy block contents into blockinherit +Failed to resolve AST +semodule: Failed! + +Remove (blockinherit container) from all templates so that "process" and +"socket" are only defined once (by inheriting "container" block in the +generated policy). +All allow rules referencing "process" and "socket" now need to be +enclosed in an optional block. + +While at it, unify indentation. + +Signed-off-by: Vit Mojzis +--- + udica/templates/config_container.cil | 33 ++++++++++--------- + udica/templates/home_container.cil | 48 +++++++++++++++------------- + udica/templates/log_container.cil | 44 +++++++++++++------------ + udica/templates/net_container.cil | 32 +++++++++---------- + udica/templates/tmp_container.cil | 18 +++++------ + udica/templates/tty_container.cil | 13 ++++---- + udica/templates/virt_container.cil | 20 ++++++------ + udica/templates/x_container.cil | 30 ++++++++--------- + 8 files changed, 120 insertions(+), 118 deletions(-) + +diff --git a/udica/templates/config_container.cil b/udica/templates/config_container.cil +index abd2c0e..6014f90 100644 +--- a/udica/templates/config_container.cil ++++ b/udica/templates/config_container.cil +@@ -1,25 +1,24 @@ + (block config_container +- (blockinherit container) +- +- (allow process configfile (dir (ioctl read getattr lock search open))) +- (allow process configfile (file (ioctl read getattr lock open))) +- (allow process configfile (lnk_file (read getattr))) +- ++ (optional config_container_optional ++ (allow process configfile (dir (ioctl read getattr lock search open))) ++ (allow process configfile (file (ioctl read getattr lock open))) ++ (allow process configfile (lnk_file (read getattr))) ++ ) + ) + + (block config_rw_container +- (blockinherit config_container) +- +- (allow process configfile (dir (ioctl read write getattr lock append open))) +- (allow process configfile (file (ioctl read write getattr lock append open))) +- (allow process configfile (lnk_file (ioctl read write getattr lock append open))) ++ (blockinherit config_container) ++ (optional config_rw_container_optional ++ (allow process configfile (dir (ioctl read write getattr lock append open))) ++ (allow process configfile (file (ioctl read write getattr lock append open))) ++ (allow process configfile (lnk_file (ioctl read write getattr lock append open))) ++ ) + ) + + (block config_manage_container +- (blockinherit container) +- +- (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) +- (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) +- (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) +- ++ (optional config_manage_container_optional ++ (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) ++ (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ ) + ) +diff --git a/udica/templates/home_container.cil b/udica/templates/home_container.cil +index 2683606..33499bc 100644 +--- a/udica/templates/home_container.cil ++++ b/udica/templates/home_container.cil +@@ -1,33 +1,37 @@ + (block home_container +- (blockinherit container) ++ (optional home_container_optional ++ (allow process process (capability (dac_override ))) + +- (allow process process (capability (dac_override ))) ++ (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) ++ (allow process home_root_t (dir (getattr search open read lock ioctl))) ++ (allow process user_home_t (dir (getattr search open read lock ioctl))) + +- (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) +- (allow process home_root_t (dir (getattr search open read lock ioctl))) +- (allow process user_home_t (dir (getattr search open read lock ioctl))) +- +- (allow process user_home_dir_t (file (getattr ioctl lock open read))) +- (allow process user_home_t (file (getattr ioctl lock open read))) ++ (allow process user_home_dir_t (file (getattr ioctl lock open read))) ++ (allow process user_home_t (file (getattr ioctl lock open read))) ++ ) + ) + + + (block home_rw_container +- (blockinherit home_container) +- (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- +- (allow process user_home_t (file (open getattr read write append ioctl lock))) +- (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) ++ (blockinherit home_container) ++ (optional home_rw_container_optional ++ (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ ++ (allow process user_home_t (file (open getattr read write append ioctl lock))) ++ (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) ++ ) + ) + + (block home_manage_container +- (blockinherit home_rw_container) +- (allow process user_home_dir_t (dir (create unlink rename rmdir ))) +- (allow process home_root_t (dir (create unlink rename rmdir ))) +- (allow process user_home_t (dir (create unlink rename rmdir ))) +- +- (allow process user_home_t (file (create rename link unlink ))) +- (allow process user_home_dir_t (file (create rename link unlink ))) ++ (blockinherit home_rw_container) ++ (optional home_manage_container_optional ++ (allow process user_home_dir_t (dir (create unlink rename rmdir ))) ++ (allow process home_root_t (dir (create unlink rename rmdir ))) ++ (allow process user_home_t (dir (create unlink rename rmdir ))) ++ ++ (allow process user_home_t (file (create rename link unlink ))) ++ (allow process user_home_dir_t (file (create rename link unlink ))) ++ ) + ) +diff --git a/udica/templates/log_container.cil b/udica/templates/log_container.cil +index 767c669..a5ecf45 100644 +--- a/udica/templates/log_container.cil ++++ b/udica/templates/log_container.cil +@@ -1,31 +1,35 @@ + (block log_container +- (blockinherit container) +- +- (allow process var_t (dir (getattr search open))) +- (allow process logfile (dir (ioctl read getattr lock search open))) +- (allow process logfile (file (ioctl read getattr lock open map))) +- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ (optional log_container_optional ++ (allow process var_t (dir (getattr search open))) ++ (allow process logfile (dir (ioctl read getattr lock search open))) ++ (allow process logfile (file (ioctl read getattr lock open map))) ++ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ ) + ) + + + (block log_rw_container +- (blockinherit log_container) ++ (blockinherit log_container) + +- (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) +- (allow process logfile (file (ioctl read write create getattr setattr lock append open))) +- (allow process logfile (lnk_file (ioctl read write getattr lock append open))) +- (allow process var_t (dir (getattr search open))) +- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ (optional log_rw_container_optional ++ (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) ++ (allow process logfile (file (ioctl read write create getattr setattr lock append open))) ++ (allow process logfile (lnk_file (ioctl read write getattr lock append open))) ++ (allow process var_t (dir (getattr search open))) ++ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ ) + ) + + (block log_manage_container +- (blockinherit log_rw_container) ++ (blockinherit log_rw_container) + +- (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) +- (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) +- (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) +- (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read write getattr lock open))) ++ (optional log_manage_container_optional ++ (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) ++ (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) ++ (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read write getattr lock open))) ++ ) + ) +diff --git a/udica/templates/net_container.cil b/udica/templates/net_container.cil +index f839ed3..a89d548 100644 +--- a/udica/templates/net_container.cil ++++ b/udica/templates/net_container.cil +@@ -1,25 +1,25 @@ + (block net_container +- (blockinherit container) +- (typeattributeset sandbox_net_domain (process)) ++ (optional net_container_optional ++ (typeattributeset sandbox_net_domain (process)) ++ ) + ) + + (block restricted_net_container +- (blockinherit container) ++ (optional restricted_net_container_optional ++ (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) ++ (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) ++ (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) + +- (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) +- (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) +- (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) ++ (allow process proc_t (lnk_file (read))) + +- (allow process proc_t (lnk_file (read))) ++ (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) ++ (allow process node_t (node (udp_recv recvfrom))) ++ (allow process node_t (node (udp_send sendto))) + +- (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) +- (allow process node_t (node (udp_recv recvfrom))) +- (allow process node_t (node (udp_send sendto))) ++ (allow process node_t (udp_socket (node_bind))) ++ (allow process node_t (tcp_socket (node_bind))) + +- (allow process node_t (udp_socket (node_bind))) +- (allow process node_t (tcp_socket (node_bind))) +- +- (allow process http_port_t (tcp_socket (name_connect))) +- (allow process http_port_t (tcp_socket (recv_msg send_msg))) ++ (allow process http_port_t (tcp_socket (name_connect))) ++ (allow process http_port_t (tcp_socket (recv_msg send_msg))) ++ ) + ) +- +diff --git a/udica/templates/tmp_container.cil b/udica/templates/tmp_container.cil +index 3b3e940..c2a899b 100644 +--- a/udica/templates/tmp_container.cil ++++ b/udica/templates/tmp_container.cil +@@ -1,15 +1,15 @@ + (block tmp_container +- (blockinherit container) +- +- (allow process tmpfile (dir (getattr search open))) +- (allow process tmpfile (file (ioctl read getattr lock open))) +- ++ (optional tmp_container_optional ++ (allow process tmpfile (dir (getattr search open))) ++ (allow process tmpfile (file (ioctl read getattr lock open))) ++ ) + ) + + (block tmp_rw_container +- (blockinherit tmp_container) +- +- (allow process tmpfile (file (ioctl read write getattr lock append open))) +- (allow process tmpfile (dir (ioctl read write getattr lock append open))) ++ (blockinherit tmp_container) + ++ (optional tmp_rw_container_optional ++ (allow process tmpfile (file (ioctl read write getattr lock append open))) ++ (allow process tmpfile (dir (ioctl read write getattr lock append open))) ++ ) + ) +diff --git a/udica/templates/tty_container.cil b/udica/templates/tty_container.cil +index 444b5f8..7a5522e 100644 +--- a/udica/templates/tty_container.cil ++++ b/udica/templates/tty_container.cil +@@ -1,10 +1,9 @@ + (block tty_container +- (blockinherit container) ++ (optional tty_container_optional ++ (allow process device_t (dir (getattr search open))) ++ (allow process device_t (dir (ioctl read getattr lock search open))) ++ (allow process device_t (lnk_file (read getattr))) + +- (allow process device_t (dir (getattr search open))) +- (allow process device_t (dir (ioctl read getattr lock search open))) +- (allow process device_t (lnk_file (read getattr))) +- +- (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) ++ (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) ++ ) + ) +- +diff --git a/udica/templates/virt_container.cil b/udica/templates/virt_container.cil +index 8ecae54..0728eba 100644 +--- a/udica/templates/virt_container.cil ++++ b/udica/templates/virt_container.cil +@@ -1,16 +1,14 @@ + (block virt_container +- (blockinherit container) ++ (optional virt_container_optional ++ (allow process var_t (dir (getattr search open))) ++ (allow process var_t (lnk_file (read getattr))) + +- (allow process var_t (dir (getattr search open))) +- (allow process var_t (lnk_file (read getattr))) ++ (allow process var_run_t (dir (getattr search open))) ++ (allow process var_run_t (lnk_file (read getattr))) + +- (allow process var_run_t (dir (getattr search open))) +- (allow process var_run_t (lnk_file (read getattr))) +- +- (allow process virt_var_run_t (dir (getattr search open))) +- (allow process virt_var_run_t (sock_file (write getattr append open))) +- +- (allow process virtd_t (unix_stream_socket (connectto))) ++ (allow process virt_var_run_t (dir (getattr search open))) ++ (allow process virt_var_run_t (sock_file (write getattr append open))) + ++ (allow process virtd_t (unix_stream_socket (connectto))) ++ ) + ) +- +diff --git a/udica/templates/x_container.cil b/udica/templates/x_container.cil +index ee7441e..0a6ddb9 100644 +--- a/udica/templates/x_container.cil ++++ b/udica/templates/x_container.cil +@@ -1,27 +1,25 @@ + (block x_container +- (blockinherit container) ++ (optional x_container_optional ++ (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) + +- (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) ++ (allow process xserver_t (unix_stream_socket (connectto))) + +- (allow process xserver_t (unix_stream_socket (connectto))) ++ (allow process device_t (dir (getattr search open))) + +- (allow process device_t (dir (getattr search open))) ++ (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) + +- (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) ++ (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) + +- (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) ++ (allow process urandom_device_t (chr_file (open read))) + +- (allow process urandom_device_t (chr_file (open read))) ++ (allow process tmpfs_t (dir (getattr search open))) + +- (allow process tmpfs_t (dir (getattr search open))) ++ (allow process tmp_t (dir (getattr search open))) ++ (allow process tmp_t (lnk_file (read getattr))) + +- (allow process tmp_t (dir (getattr search open))) +- (allow process tmp_t (lnk_file (read getattr))) +- +- (allow process xserver_tmp_t (dir (getattr search open))) +- (allow process xserver_tmp_t (sock_file (write getattr append open))) +- +- (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) ++ (allow process xserver_tmp_t (dir (getattr search open))) ++ (allow process xserver_tmp_t (sock_file (write getattr append open))) + ++ (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) ++ ) + ) +- +-- +2.30.2 + diff --git a/sources b/sources index 54ee37a..c04350e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.4.tar.gz) = 17d4d33939e15a113badf7df17b55c51cdf2659b49f6ae90c8e2f0b741ffabed019ee2b9a1dd8123f5ca96f3f1111fcad74d8480fdf00bc1b10b6e2d5f2948a4 +SHA512 (v0.2.5.tar.gz) = 6321442ea546a630e08d3dd007bab153e47e15dce821eb824a899b239aa9e00d0edc3a239d3da1c4161afc72147f20d372e34a399a195a4b4ade12049b10df57 diff --git a/udica.spec b/udica.spec index 22b9d16..e13e10e 100644 --- a/udica.spec +++ b/udica.spec @@ -1,8 +1,9 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.4 -Release: 4%{?dist} +Version: 0.2.5 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz +Patch001: 0001-Update-templates-to-work-properly-with-new-cil-parse.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -60,6 +61,13 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Aug 25 2021 Vit Mojzis - 0.2.5-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.5 +- Replace capability dictionary with str.lower() +- Enable udica to generate policies with fifo class +- Sort container inspect data before processing +- Update templates to work properly with new cil parser + * Tue Mar 16 2021 Vit Mojzis - 0.2.4-4 - Remove %check section From b702a462b3eb6d9e4358316575e35cb2b50fe5d1 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 14 Sep 2021 17:50:12 +0200 Subject: [PATCH 4/5] tests: Require container-selinux Policy templates where moved to container-selinux package and udica doesn't work properly without them. Sanity test temporarily needs git for downloading policy templates. Those will soon be available via container-selinux. Signed-off-by: Vit Mojzis --- tests/docker/runtest.sh | 1 + tests/sanity/runtest.sh | 1 + tests/tests.yml | 9 +++++++++ 3 files changed, 11 insertions(+) diff --git a/tests/docker/runtest.sh b/tests/docker/runtest.sh index c2290d5..1850b3c 100755 --- a/tests/docker/runtest.sh +++ b/tests/docker/runtest.sh @@ -33,6 +33,7 @@ PACKAGE="udica" rlJournalStart rlPhaseStartSetup rlAssertRpm "udica" + rlAssertRpm "container-selinux" rlAssertRpm "policycoreutils" rlAssertRpm "podman" rlAssertRpm "docker" diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index c8c5f34..8a7cfb7 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -33,6 +33,7 @@ PACKAGE="udica" rlJournalStart rlPhaseStartSetup rlAssertRpm "udica" + rlAssertRpm "container-selinux" rlAssertRpm "policycoreutils" rlAssertRpm "podman" OUTPUT_FILE=$(mktemp) diff --git a/tests/tests.yml b/tests/tests.yml index 42a2022..e8388b7 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -8,6 +8,8 @@ - role: standard-test-basic required_packages: - python3 + - container-selinux + - git tests: - smoke: dir: ./source @@ -16,6 +18,11 @@ dir: ./source run: python3 tests/test_integration.py +- hosts: localhost + tags: + - classic + - container + roles: - role: standard-test-beakerlib tags: - classic @@ -23,3 +30,5 @@ - sanity required_packages: - podman + - udica + - container-selinux From 136ff6eaa621f2e410dc54351e2bb028e6d2b8b3 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 13 Sep 2021 18:19:15 +0200 Subject: [PATCH 5/5] udica-0.2.6-1 - New release https://github.com/containers/udica/releases/tag/v0.2.6 - Move policy templates to container-selinux repo --- .gitignore | 1 + ...-to-work-properly-with-new-cil-parse.patch | 381 ------------------ sources | 2 +- udica.spec | 13 +- 4 files changed, 9 insertions(+), 388 deletions(-) delete mode 100644 0001-Update-templates-to-work-properly-with-new-cil-parse.patch diff --git a/.gitignore b/.gitignore index 42c7c98..389f6b5 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /v0.2.3.tar.gz /v0.2.4.tar.gz /v0.2.5.tar.gz +/v0.2.6.tar.gz diff --git a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch deleted file mode 100644 index 5d1ab67..0000000 --- a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch +++ /dev/null @@ -1,381 +0,0 @@ -From 09bf6b339f1219769ada2c108c429013af19ceb5 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 26 Aug 2021 17:48:45 +0200 -Subject: [PATCH] Update templates to work properly with new cil parser - -Cil parser was recently updated to reject the following: -(block template1 (type t) ) -(block template2 (blockinherit template1)) -(block b (blockinherit template1) (blockinherit template2)) - -Re-declaration of type t -Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1 -Failed to copy block contents into blockinherit -Failed to resolve AST -semodule: Failed! - -Remove (blockinherit container) from all templates so that "process" and -"socket" are only defined once (by inheriting "container" block in the -generated policy). -All allow rules referencing "process" and "socket" now need to be -enclosed in an optional block. - -While at it, unify indentation. - -Signed-off-by: Vit Mojzis ---- - udica/templates/config_container.cil | 33 ++++++++++--------- - udica/templates/home_container.cil | 48 +++++++++++++++------------- - udica/templates/log_container.cil | 44 +++++++++++++------------ - udica/templates/net_container.cil | 32 +++++++++---------- - udica/templates/tmp_container.cil | 18 +++++------ - udica/templates/tty_container.cil | 13 ++++---- - udica/templates/virt_container.cil | 20 ++++++------ - udica/templates/x_container.cil | 30 ++++++++--------- - 8 files changed, 120 insertions(+), 118 deletions(-) - -diff --git a/udica/templates/config_container.cil b/udica/templates/config_container.cil -index abd2c0e..6014f90 100644 ---- a/udica/templates/config_container.cil -+++ b/udica/templates/config_container.cil -@@ -1,25 +1,24 @@ - (block config_container -- (blockinherit container) -- -- (allow process configfile (dir (ioctl read getattr lock search open))) -- (allow process configfile (file (ioctl read getattr lock open))) -- (allow process configfile (lnk_file (read getattr))) -- -+ (optional config_container_optional -+ (allow process configfile (dir (ioctl read getattr lock search open))) -+ (allow process configfile (file (ioctl read getattr lock open))) -+ (allow process configfile (lnk_file (read getattr))) -+ ) - ) - - (block config_rw_container -- (blockinherit config_container) -- -- (allow process configfile (dir (ioctl read write getattr lock append open))) -- (allow process configfile (file (ioctl read write getattr lock append open))) -- (allow process configfile (lnk_file (ioctl read write getattr lock append open))) -+ (blockinherit config_container) -+ (optional config_rw_container_optional -+ (allow process configfile (dir (ioctl read write getattr lock append open))) -+ (allow process configfile (file (ioctl read write getattr lock append open))) -+ (allow process configfile (lnk_file (ioctl read write getattr lock append open))) -+ ) - ) - - (block config_manage_container -- (blockinherit container) -- -- (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -- (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -- (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) -- -+ (optional config_manage_container_optional -+ (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -+ (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ ) - ) -diff --git a/udica/templates/home_container.cil b/udica/templates/home_container.cil -index 2683606..33499bc 100644 ---- a/udica/templates/home_container.cil -+++ b/udica/templates/home_container.cil -@@ -1,33 +1,37 @@ - (block home_container -- (blockinherit container) -+ (optional home_container_optional -+ (allow process process (capability (dac_override ))) - -- (allow process process (capability (dac_override ))) -+ (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) -+ (allow process home_root_t (dir (getattr search open read lock ioctl))) -+ (allow process user_home_t (dir (getattr search open read lock ioctl))) - -- (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) -- (allow process home_root_t (dir (getattr search open read lock ioctl))) -- (allow process user_home_t (dir (getattr search open read lock ioctl))) -- -- (allow process user_home_dir_t (file (getattr ioctl lock open read))) -- (allow process user_home_t (file (getattr ioctl lock open read))) -+ (allow process user_home_dir_t (file (getattr ioctl lock open read))) -+ (allow process user_home_t (file (getattr ioctl lock open read))) -+ ) - ) - - - (block home_rw_container -- (blockinherit home_container) -- (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- -- (allow process user_home_t (file (open getattr read write append ioctl lock))) -- (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) -+ (blockinherit home_container) -+ (optional home_rw_container_optional -+ (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ -+ (allow process user_home_t (file (open getattr read write append ioctl lock))) -+ (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) -+ ) - ) - - (block home_manage_container -- (blockinherit home_rw_container) -- (allow process user_home_dir_t (dir (create unlink rename rmdir ))) -- (allow process home_root_t (dir (create unlink rename rmdir ))) -- (allow process user_home_t (dir (create unlink rename rmdir ))) -- -- (allow process user_home_t (file (create rename link unlink ))) -- (allow process user_home_dir_t (file (create rename link unlink ))) -+ (blockinherit home_rw_container) -+ (optional home_manage_container_optional -+ (allow process user_home_dir_t (dir (create unlink rename rmdir ))) -+ (allow process home_root_t (dir (create unlink rename rmdir ))) -+ (allow process user_home_t (dir (create unlink rename rmdir ))) -+ -+ (allow process user_home_t (file (create rename link unlink ))) -+ (allow process user_home_dir_t (file (create rename link unlink ))) -+ ) - ) -diff --git a/udica/templates/log_container.cil b/udica/templates/log_container.cil -index 767c669..a5ecf45 100644 ---- a/udica/templates/log_container.cil -+++ b/udica/templates/log_container.cil -@@ -1,31 +1,35 @@ - (block log_container -- (blockinherit container) -- -- (allow process var_t (dir (getattr search open))) -- (allow process logfile (dir (ioctl read getattr lock search open))) -- (allow process logfile (file (ioctl read getattr lock open map))) -- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ (optional log_container_optional -+ (allow process var_t (dir (getattr search open))) -+ (allow process logfile (dir (ioctl read getattr lock search open))) -+ (allow process logfile (file (ioctl read getattr lock open map))) -+ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ ) - ) - - - (block log_rw_container -- (blockinherit log_container) -+ (blockinherit log_container) - -- (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) -- (allow process logfile (file (ioctl read write create getattr setattr lock append open))) -- (allow process logfile (lnk_file (ioctl read write getattr lock append open))) -- (allow process var_t (dir (getattr search open))) -- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ (optional log_rw_container_optional -+ (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) -+ (allow process logfile (file (ioctl read write create getattr setattr lock append open))) -+ (allow process logfile (lnk_file (ioctl read write getattr lock append open))) -+ (allow process var_t (dir (getattr search open))) -+ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ ) - ) - - (block log_manage_container -- (blockinherit log_rw_container) -+ (blockinherit log_rw_container) - -- (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -- (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -- (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) -- (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read write getattr lock open))) -+ (optional log_manage_container_optional -+ (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -+ (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) -+ (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read write getattr lock open))) -+ ) - ) -diff --git a/udica/templates/net_container.cil b/udica/templates/net_container.cil -index f839ed3..a89d548 100644 ---- a/udica/templates/net_container.cil -+++ b/udica/templates/net_container.cil -@@ -1,25 +1,25 @@ - (block net_container -- (blockinherit container) -- (typeattributeset sandbox_net_domain (process)) -+ (optional net_container_optional -+ (typeattributeset sandbox_net_domain (process)) -+ ) - ) - - (block restricted_net_container -- (blockinherit container) -+ (optional restricted_net_container_optional -+ (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) -+ (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -+ (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) - -- (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) -- (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -- (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -+ (allow process proc_t (lnk_file (read))) - -- (allow process proc_t (lnk_file (read))) -+ (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) -+ (allow process node_t (node (udp_recv recvfrom))) -+ (allow process node_t (node (udp_send sendto))) - -- (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) -- (allow process node_t (node (udp_recv recvfrom))) -- (allow process node_t (node (udp_send sendto))) -+ (allow process node_t (udp_socket (node_bind))) -+ (allow process node_t (tcp_socket (node_bind))) - -- (allow process node_t (udp_socket (node_bind))) -- (allow process node_t (tcp_socket (node_bind))) -- -- (allow process http_port_t (tcp_socket (name_connect))) -- (allow process http_port_t (tcp_socket (recv_msg send_msg))) -+ (allow process http_port_t (tcp_socket (name_connect))) -+ (allow process http_port_t (tcp_socket (recv_msg send_msg))) -+ ) - ) -- -diff --git a/udica/templates/tmp_container.cil b/udica/templates/tmp_container.cil -index 3b3e940..c2a899b 100644 ---- a/udica/templates/tmp_container.cil -+++ b/udica/templates/tmp_container.cil -@@ -1,15 +1,15 @@ - (block tmp_container -- (blockinherit container) -- -- (allow process tmpfile (dir (getattr search open))) -- (allow process tmpfile (file (ioctl read getattr lock open))) -- -+ (optional tmp_container_optional -+ (allow process tmpfile (dir (getattr search open))) -+ (allow process tmpfile (file (ioctl read getattr lock open))) -+ ) - ) - - (block tmp_rw_container -- (blockinherit tmp_container) -- -- (allow process tmpfile (file (ioctl read write getattr lock append open))) -- (allow process tmpfile (dir (ioctl read write getattr lock append open))) -+ (blockinherit tmp_container) - -+ (optional tmp_rw_container_optional -+ (allow process tmpfile (file (ioctl read write getattr lock append open))) -+ (allow process tmpfile (dir (ioctl read write getattr lock append open))) -+ ) - ) -diff --git a/udica/templates/tty_container.cil b/udica/templates/tty_container.cil -index 444b5f8..7a5522e 100644 ---- a/udica/templates/tty_container.cil -+++ b/udica/templates/tty_container.cil -@@ -1,10 +1,9 @@ - (block tty_container -- (blockinherit container) -+ (optional tty_container_optional -+ (allow process device_t (dir (getattr search open))) -+ (allow process device_t (dir (ioctl read getattr lock search open))) -+ (allow process device_t (lnk_file (read getattr))) - -- (allow process device_t (dir (getattr search open))) -- (allow process device_t (dir (ioctl read getattr lock search open))) -- (allow process device_t (lnk_file (read getattr))) -- -- (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) -+ (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) -+ ) - ) -- -diff --git a/udica/templates/virt_container.cil b/udica/templates/virt_container.cil -index 8ecae54..0728eba 100644 ---- a/udica/templates/virt_container.cil -+++ b/udica/templates/virt_container.cil -@@ -1,16 +1,14 @@ - (block virt_container -- (blockinherit container) -+ (optional virt_container_optional -+ (allow process var_t (dir (getattr search open))) -+ (allow process var_t (lnk_file (read getattr))) - -- (allow process var_t (dir (getattr search open))) -- (allow process var_t (lnk_file (read getattr))) -+ (allow process var_run_t (dir (getattr search open))) -+ (allow process var_run_t (lnk_file (read getattr))) - -- (allow process var_run_t (dir (getattr search open))) -- (allow process var_run_t (lnk_file (read getattr))) -- -- (allow process virt_var_run_t (dir (getattr search open))) -- (allow process virt_var_run_t (sock_file (write getattr append open))) -- -- (allow process virtd_t (unix_stream_socket (connectto))) -+ (allow process virt_var_run_t (dir (getattr search open))) -+ (allow process virt_var_run_t (sock_file (write getattr append open))) - -+ (allow process virtd_t (unix_stream_socket (connectto))) -+ ) - ) -- -diff --git a/udica/templates/x_container.cil b/udica/templates/x_container.cil -index ee7441e..0a6ddb9 100644 ---- a/udica/templates/x_container.cil -+++ b/udica/templates/x_container.cil -@@ -1,27 +1,25 @@ - (block x_container -- (blockinherit container) -+ (optional x_container_optional -+ (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) - -- (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) -+ (allow process xserver_t (unix_stream_socket (connectto))) - -- (allow process xserver_t (unix_stream_socket (connectto))) -+ (allow process device_t (dir (getattr search open))) - -- (allow process device_t (dir (getattr search open))) -+ (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) - -- (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) -+ (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) - -- (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) -+ (allow process urandom_device_t (chr_file (open read))) - -- (allow process urandom_device_t (chr_file (open read))) -+ (allow process tmpfs_t (dir (getattr search open))) - -- (allow process tmpfs_t (dir (getattr search open))) -+ (allow process tmp_t (dir (getattr search open))) -+ (allow process tmp_t (lnk_file (read getattr))) - -- (allow process tmp_t (dir (getattr search open))) -- (allow process tmp_t (lnk_file (read getattr))) -- -- (allow process xserver_tmp_t (dir (getattr search open))) -- (allow process xserver_tmp_t (sock_file (write getattr append open))) -- -- (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) -+ (allow process xserver_tmp_t (dir (getattr search open))) -+ (allow process xserver_tmp_t (sock_file (write getattr append open))) - -+ (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) -+ ) - ) -- --- -2.30.2 - diff --git a/sources b/sources index c04350e..b0e6d67 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.5.tar.gz) = 6321442ea546a630e08d3dd007bab153e47e15dce821eb824a899b239aa9e00d0edc3a239d3da1c4161afc72147f20d372e34a399a195a4b4ade12049b10df57 +SHA512 (v0.2.6.tar.gz) = 29295c9d95ecb15aed7e226d92a0b838046cf607e98956c66a83ad0f4ddf58b255586c24d407216ae9ddf5b11f502ae2b3a6822208d8dc8141124e68dac19265 diff --git a/udica.spec b/udica.spec index e13e10e..615c192 100644 --- a/udica.spec +++ b/udica.spec @@ -1,9 +1,8 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.5 +Version: 0.2.6 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz -Patch001: 0001-Update-templates-to-work-properly-with-new-cil-parse.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -14,6 +13,8 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif +# container-selinux provides policy templates +Requires: container-selinux >= 2.170.0-2 %description Tool for generating SELinux security profiles for containers based on @@ -30,8 +31,6 @@ inspection of container JSON file. %endif %install -install --directory %%{buildroot}%{_datadir}/udica/templates - %if 0%{?fedora} || 0%{?rhel} > 7 %{__python3} setup.py install --single-version-externally-managed --root=%{buildroot} %else @@ -46,9 +45,7 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{_bindir}/udica %dir %{_datadir}/udica %dir %{_datadir}/udica/ansible -%dir %{_datadir}/udica/templates %{_datadir}/udica/ansible/* -%{_datadir}/udica/templates/* %if 0%{?fedora} || 0%{?rhel} > 7 %license LICENSE @@ -61,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Sep 13 2021 Vit Mojzis - 0.2.6-1 +- New release https://github.com/containers/udica/releases/tag/v0.2.6 +- Move policy templates to container-selinux repo + * Wed Aug 25 2021 Vit Mojzis - 0.2.5-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.5 - Replace capability dictionary with str.lower()