From 5ca2a7899bd494db47a5198e197c47bd1482553e Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Wed, 25 Aug 2021 13:19:03 +0200 Subject: [PATCH 1/3] udica-0.2.5-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.5 - Replace capability dictionary with str.lower() - Enable udica to generate policies with fifo class - Sort container inspect data before processing - Update templates to work properly with new cil parser --- .gitignore | 1 + ...-to-work-properly-with-new-cil-parse.patch | 381 ++++++++++++++++++ sources | 2 +- udica.spec | 12 +- 4 files changed, 393 insertions(+), 3 deletions(-) create mode 100644 0001-Update-templates-to-work-properly-with-new-cil-parse.patch diff --git a/.gitignore b/.gitignore index e27bbaa..42c7c98 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,4 @@ /v0.2.2.tar.gz /v0.2.3.tar.gz /v0.2.4.tar.gz +/v0.2.5.tar.gz diff --git a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch new file mode 100644 index 0000000..5d1ab67 --- /dev/null +++ b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch @@ -0,0 +1,381 @@ +From 09bf6b339f1219769ada2c108c429013af19ceb5 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Thu, 26 Aug 2021 17:48:45 +0200 +Subject: [PATCH] Update templates to work properly with new cil parser + +Cil parser was recently updated to reject the following: +(block template1 (type t) ) +(block template2 (blockinherit template1)) +(block b (blockinherit template1) (blockinherit template2)) + +Re-declaration of type t +Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1 +Failed to copy block contents into blockinherit +Failed to resolve AST +semodule: Failed! + +Remove (blockinherit container) from all templates so that "process" and +"socket" are only defined once (by inheriting "container" block in the +generated policy). +All allow rules referencing "process" and "socket" now need to be +enclosed in an optional block. + +While at it, unify indentation. + +Signed-off-by: Vit Mojzis +--- + udica/templates/config_container.cil | 33 ++++++++++--------- + udica/templates/home_container.cil | 48 +++++++++++++++------------- + udica/templates/log_container.cil | 44 +++++++++++++------------ + udica/templates/net_container.cil | 32 +++++++++---------- + udica/templates/tmp_container.cil | 18 +++++------ + udica/templates/tty_container.cil | 13 ++++---- + udica/templates/virt_container.cil | 20 ++++++------ + udica/templates/x_container.cil | 30 ++++++++--------- + 8 files changed, 120 insertions(+), 118 deletions(-) + +diff --git a/udica/templates/config_container.cil b/udica/templates/config_container.cil +index abd2c0e..6014f90 100644 +--- a/udica/templates/config_container.cil ++++ b/udica/templates/config_container.cil +@@ -1,25 +1,24 @@ + (block config_container +- (blockinherit container) +- +- (allow process configfile (dir (ioctl read getattr lock search open))) +- (allow process configfile (file (ioctl read getattr lock open))) +- (allow process configfile (lnk_file (read getattr))) +- ++ (optional config_container_optional ++ (allow process configfile (dir (ioctl read getattr lock search open))) ++ (allow process configfile (file (ioctl read getattr lock open))) ++ (allow process configfile (lnk_file (read getattr))) ++ ) + ) + + (block config_rw_container +- (blockinherit config_container) +- +- (allow process configfile (dir (ioctl read write getattr lock append open))) +- (allow process configfile (file (ioctl read write getattr lock append open))) +- (allow process configfile (lnk_file (ioctl read write getattr lock append open))) ++ (blockinherit config_container) ++ (optional config_rw_container_optional ++ (allow process configfile (dir (ioctl read write getattr lock append open))) ++ (allow process configfile (file (ioctl read write getattr lock append open))) ++ (allow process configfile (lnk_file (ioctl read write getattr lock append open))) ++ ) + ) + + (block config_manage_container +- (blockinherit container) +- +- (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) +- (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) +- (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) +- ++ (optional config_manage_container_optional ++ (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) ++ (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ ) + ) +diff --git a/udica/templates/home_container.cil b/udica/templates/home_container.cil +index 2683606..33499bc 100644 +--- a/udica/templates/home_container.cil ++++ b/udica/templates/home_container.cil +@@ -1,33 +1,37 @@ + (block home_container +- (blockinherit container) ++ (optional home_container_optional ++ (allow process process (capability (dac_override ))) + +- (allow process process (capability (dac_override ))) ++ (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) ++ (allow process home_root_t (dir (getattr search open read lock ioctl))) ++ (allow process user_home_t (dir (getattr search open read lock ioctl))) + +- (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) +- (allow process home_root_t (dir (getattr search open read lock ioctl))) +- (allow process user_home_t (dir (getattr search open read lock ioctl))) +- +- (allow process user_home_dir_t (file (getattr ioctl lock open read))) +- (allow process user_home_t (file (getattr ioctl lock open read))) ++ (allow process user_home_dir_t (file (getattr ioctl lock open read))) ++ (allow process user_home_t (file (getattr ioctl lock open read))) ++ ) + ) + + + (block home_rw_container +- (blockinherit home_container) +- (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) +- +- (allow process user_home_t (file (open getattr read write append ioctl lock))) +- (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) ++ (blockinherit home_container) ++ (optional home_rw_container_optional ++ (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) ++ ++ (allow process user_home_t (file (open getattr read write append ioctl lock))) ++ (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) ++ ) + ) + + (block home_manage_container +- (blockinherit home_rw_container) +- (allow process user_home_dir_t (dir (create unlink rename rmdir ))) +- (allow process home_root_t (dir (create unlink rename rmdir ))) +- (allow process user_home_t (dir (create unlink rename rmdir ))) +- +- (allow process user_home_t (file (create rename link unlink ))) +- (allow process user_home_dir_t (file (create rename link unlink ))) ++ (blockinherit home_rw_container) ++ (optional home_manage_container_optional ++ (allow process user_home_dir_t (dir (create unlink rename rmdir ))) ++ (allow process home_root_t (dir (create unlink rename rmdir ))) ++ (allow process user_home_t (dir (create unlink rename rmdir ))) ++ ++ (allow process user_home_t (file (create rename link unlink ))) ++ (allow process user_home_dir_t (file (create rename link unlink ))) ++ ) + ) +diff --git a/udica/templates/log_container.cil b/udica/templates/log_container.cil +index 767c669..a5ecf45 100644 +--- a/udica/templates/log_container.cil ++++ b/udica/templates/log_container.cil +@@ -1,31 +1,35 @@ + (block log_container +- (blockinherit container) +- +- (allow process var_t (dir (getattr search open))) +- (allow process logfile (dir (ioctl read getattr lock search open))) +- (allow process logfile (file (ioctl read getattr lock open map))) +- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ (optional log_container_optional ++ (allow process var_t (dir (getattr search open))) ++ (allow process logfile (dir (ioctl read getattr lock search open))) ++ (allow process logfile (file (ioctl read getattr lock open map))) ++ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ ) + ) + + + (block log_rw_container +- (blockinherit log_container) ++ (blockinherit log_container) + +- (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) +- (allow process logfile (file (ioctl read write create getattr setattr lock append open))) +- (allow process logfile (lnk_file (ioctl read write getattr lock append open))) +- (allow process var_t (dir (getattr search open))) +- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ (optional log_rw_container_optional ++ (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) ++ (allow process logfile (file (ioctl read write create getattr setattr lock append open))) ++ (allow process logfile (lnk_file (ioctl read write getattr lock append open))) ++ (allow process var_t (dir (getattr search open))) ++ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read getattr lock open))) ++ ) + ) + + (block log_manage_container +- (blockinherit log_rw_container) ++ (blockinherit log_rw_container) + +- (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) +- (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) +- (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) +- (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) +- (allow process auditd_log_t (file (ioctl read write getattr lock open))) ++ (optional log_manage_container_optional ++ (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) ++ (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) ++ (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) ++ (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) ++ (allow process auditd_log_t (file (ioctl read write getattr lock open))) ++ ) + ) +diff --git a/udica/templates/net_container.cil b/udica/templates/net_container.cil +index f839ed3..a89d548 100644 +--- a/udica/templates/net_container.cil ++++ b/udica/templates/net_container.cil +@@ -1,25 +1,25 @@ + (block net_container +- (blockinherit container) +- (typeattributeset sandbox_net_domain (process)) ++ (optional net_container_optional ++ (typeattributeset sandbox_net_domain (process)) ++ ) + ) + + (block restricted_net_container +- (blockinherit container) ++ (optional restricted_net_container_optional ++ (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) ++ (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) ++ (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) + +- (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) +- (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) +- (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) ++ (allow process proc_t (lnk_file (read))) + +- (allow process proc_t (lnk_file (read))) ++ (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) ++ (allow process node_t (node (udp_recv recvfrom))) ++ (allow process node_t (node (udp_send sendto))) + +- (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) +- (allow process node_t (node (udp_recv recvfrom))) +- (allow process node_t (node (udp_send sendto))) ++ (allow process node_t (udp_socket (node_bind))) ++ (allow process node_t (tcp_socket (node_bind))) + +- (allow process node_t (udp_socket (node_bind))) +- (allow process node_t (tcp_socket (node_bind))) +- +- (allow process http_port_t (tcp_socket (name_connect))) +- (allow process http_port_t (tcp_socket (recv_msg send_msg))) ++ (allow process http_port_t (tcp_socket (name_connect))) ++ (allow process http_port_t (tcp_socket (recv_msg send_msg))) ++ ) + ) +- +diff --git a/udica/templates/tmp_container.cil b/udica/templates/tmp_container.cil +index 3b3e940..c2a899b 100644 +--- a/udica/templates/tmp_container.cil ++++ b/udica/templates/tmp_container.cil +@@ -1,15 +1,15 @@ + (block tmp_container +- (blockinherit container) +- +- (allow process tmpfile (dir (getattr search open))) +- (allow process tmpfile (file (ioctl read getattr lock open))) +- ++ (optional tmp_container_optional ++ (allow process tmpfile (dir (getattr search open))) ++ (allow process tmpfile (file (ioctl read getattr lock open))) ++ ) + ) + + (block tmp_rw_container +- (blockinherit tmp_container) +- +- (allow process tmpfile (file (ioctl read write getattr lock append open))) +- (allow process tmpfile (dir (ioctl read write getattr lock append open))) ++ (blockinherit tmp_container) + ++ (optional tmp_rw_container_optional ++ (allow process tmpfile (file (ioctl read write getattr lock append open))) ++ (allow process tmpfile (dir (ioctl read write getattr lock append open))) ++ ) + ) +diff --git a/udica/templates/tty_container.cil b/udica/templates/tty_container.cil +index 444b5f8..7a5522e 100644 +--- a/udica/templates/tty_container.cil ++++ b/udica/templates/tty_container.cil +@@ -1,10 +1,9 @@ + (block tty_container +- (blockinherit container) ++ (optional tty_container_optional ++ (allow process device_t (dir (getattr search open))) ++ (allow process device_t (dir (ioctl read getattr lock search open))) ++ (allow process device_t (lnk_file (read getattr))) + +- (allow process device_t (dir (getattr search open))) +- (allow process device_t (dir (ioctl read getattr lock search open))) +- (allow process device_t (lnk_file (read getattr))) +- +- (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) ++ (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) ++ ) + ) +- +diff --git a/udica/templates/virt_container.cil b/udica/templates/virt_container.cil +index 8ecae54..0728eba 100644 +--- a/udica/templates/virt_container.cil ++++ b/udica/templates/virt_container.cil +@@ -1,16 +1,14 @@ + (block virt_container +- (blockinherit container) ++ (optional virt_container_optional ++ (allow process var_t (dir (getattr search open))) ++ (allow process var_t (lnk_file (read getattr))) + +- (allow process var_t (dir (getattr search open))) +- (allow process var_t (lnk_file (read getattr))) ++ (allow process var_run_t (dir (getattr search open))) ++ (allow process var_run_t (lnk_file (read getattr))) + +- (allow process var_run_t (dir (getattr search open))) +- (allow process var_run_t (lnk_file (read getattr))) +- +- (allow process virt_var_run_t (dir (getattr search open))) +- (allow process virt_var_run_t (sock_file (write getattr append open))) +- +- (allow process virtd_t (unix_stream_socket (connectto))) ++ (allow process virt_var_run_t (dir (getattr search open))) ++ (allow process virt_var_run_t (sock_file (write getattr append open))) + ++ (allow process virtd_t (unix_stream_socket (connectto))) ++ ) + ) +- +diff --git a/udica/templates/x_container.cil b/udica/templates/x_container.cil +index ee7441e..0a6ddb9 100644 +--- a/udica/templates/x_container.cil ++++ b/udica/templates/x_container.cil +@@ -1,27 +1,25 @@ + (block x_container +- (blockinherit container) ++ (optional x_container_optional ++ (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) + +- (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) ++ (allow process xserver_t (unix_stream_socket (connectto))) + +- (allow process xserver_t (unix_stream_socket (connectto))) ++ (allow process device_t (dir (getattr search open))) + +- (allow process device_t (dir (getattr search open))) ++ (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) + +- (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) ++ (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) + +- (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) ++ (allow process urandom_device_t (chr_file (open read))) + +- (allow process urandom_device_t (chr_file (open read))) ++ (allow process tmpfs_t (dir (getattr search open))) + +- (allow process tmpfs_t (dir (getattr search open))) ++ (allow process tmp_t (dir (getattr search open))) ++ (allow process tmp_t (lnk_file (read getattr))) + +- (allow process tmp_t (dir (getattr search open))) +- (allow process tmp_t (lnk_file (read getattr))) +- +- (allow process xserver_tmp_t (dir (getattr search open))) +- (allow process xserver_tmp_t (sock_file (write getattr append open))) +- +- (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) ++ (allow process xserver_tmp_t (dir (getattr search open))) ++ (allow process xserver_tmp_t (sock_file (write getattr append open))) + ++ (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) ++ ) + ) +- +-- +2.30.2 + diff --git a/sources b/sources index 54ee37a..c04350e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.4.tar.gz) = 17d4d33939e15a113badf7df17b55c51cdf2659b49f6ae90c8e2f0b741ffabed019ee2b9a1dd8123f5ca96f3f1111fcad74d8480fdf00bc1b10b6e2d5f2948a4 +SHA512 (v0.2.5.tar.gz) = 6321442ea546a630e08d3dd007bab153e47e15dce821eb824a899b239aa9e00d0edc3a239d3da1c4161afc72147f20d372e34a399a195a4b4ade12049b10df57 diff --git a/udica.spec b/udica.spec index c7b80b4..c72c842 100644 --- a/udica.spec +++ b/udica.spec @@ -1,8 +1,9 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.4 -Release: 5%{?dist} +Version: 0.2.5 +Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz +Patch001: 0001-Update-templates-to-work-properly-with-new-cil-parse.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -60,6 +61,13 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Wed Aug 25 2021 Vit Mojzis - 0.2.5-1 +- New rebase https://github.com/containers/udica/releases/tag/v0.2.5 +- Replace capability dictionary with str.lower() +- Enable udica to generate policies with fifo class +- Sort container inspect data before processing +- Update templates to work properly with new cil parser + * Fri Jul 23 2021 Fedora Release Engineering - 0.2.4-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild From 112759dcab3ad1b9c7fa8b82de0e1e4980da38d7 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Tue, 14 Sep 2021 17:50:12 +0200 Subject: [PATCH 2/3] tests: Require container-selinux Policy templates where moved to container-selinux package and udica doesn't work properly without them. Sanity test temporarily needs git for downloading policy templates. Those will soon be available via container-selinux. Signed-off-by: Vit Mojzis --- tests/docker/runtest.sh | 1 + tests/sanity/runtest.sh | 1 + tests/tests.yml | 9 +++++++++ 3 files changed, 11 insertions(+) diff --git a/tests/docker/runtest.sh b/tests/docker/runtest.sh index c2290d5..1850b3c 100755 --- a/tests/docker/runtest.sh +++ b/tests/docker/runtest.sh @@ -33,6 +33,7 @@ PACKAGE="udica" rlJournalStart rlPhaseStartSetup rlAssertRpm "udica" + rlAssertRpm "container-selinux" rlAssertRpm "policycoreutils" rlAssertRpm "podman" rlAssertRpm "docker" diff --git a/tests/sanity/runtest.sh b/tests/sanity/runtest.sh index c8c5f34..8a7cfb7 100755 --- a/tests/sanity/runtest.sh +++ b/tests/sanity/runtest.sh @@ -33,6 +33,7 @@ PACKAGE="udica" rlJournalStart rlPhaseStartSetup rlAssertRpm "udica" + rlAssertRpm "container-selinux" rlAssertRpm "policycoreutils" rlAssertRpm "podman" OUTPUT_FILE=$(mktemp) diff --git a/tests/tests.yml b/tests/tests.yml index 42a2022..e8388b7 100644 --- a/tests/tests.yml +++ b/tests/tests.yml @@ -8,6 +8,8 @@ - role: standard-test-basic required_packages: - python3 + - container-selinux + - git tests: - smoke: dir: ./source @@ -16,6 +18,11 @@ dir: ./source run: python3 tests/test_integration.py +- hosts: localhost + tags: + - classic + - container + roles: - role: standard-test-beakerlib tags: - classic @@ -23,3 +30,5 @@ - sanity required_packages: - podman + - udica + - container-selinux From fa971c73bf7dd1c9100755b8a5e2863ae0241b13 Mon Sep 17 00:00:00 2001 From: Vit Mojzis Date: Mon, 13 Sep 2021 18:19:15 +0200 Subject: [PATCH 3/3] udica-0.2.6-1 - New release https://github.com/containers/udica/releases/tag/v0.2.6 - Move policy templates to container-selinux repo --- .gitignore | 1 + ...-to-work-properly-with-new-cil-parse.patch | 381 ------------------ sources | 2 +- udica.spec | 13 +- 4 files changed, 9 insertions(+), 388 deletions(-) delete mode 100644 0001-Update-templates-to-work-properly-with-new-cil-parse.patch diff --git a/.gitignore b/.gitignore index 42c7c98..389f6b5 100644 --- a/.gitignore +++ b/.gitignore @@ -13,3 +13,4 @@ /v0.2.3.tar.gz /v0.2.4.tar.gz /v0.2.5.tar.gz +/v0.2.6.tar.gz diff --git a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch b/0001-Update-templates-to-work-properly-with-new-cil-parse.patch deleted file mode 100644 index 5d1ab67..0000000 --- a/0001-Update-templates-to-work-properly-with-new-cil-parse.patch +++ /dev/null @@ -1,381 +0,0 @@ -From 09bf6b339f1219769ada2c108c429013af19ceb5 Mon Sep 17 00:00:00 2001 -From: Vit Mojzis -Date: Thu, 26 Aug 2021 17:48:45 +0200 -Subject: [PATCH] Update templates to work properly with new cil parser - -Cil parser was recently updated to reject the following: -(block template1 (type t) ) -(block template2 (blockinherit template1)) -(block b (blockinherit template1) (blockinherit template2)) - -Re-declaration of type t -Previous declaration of type at /var/lib/selinux/targeted/tmp/modules/400/test/cil:1 -Failed to copy block contents into blockinherit -Failed to resolve AST -semodule: Failed! - -Remove (blockinherit container) from all templates so that "process" and -"socket" are only defined once (by inheriting "container" block in the -generated policy). -All allow rules referencing "process" and "socket" now need to be -enclosed in an optional block. - -While at it, unify indentation. - -Signed-off-by: Vit Mojzis ---- - udica/templates/config_container.cil | 33 ++++++++++--------- - udica/templates/home_container.cil | 48 +++++++++++++++------------- - udica/templates/log_container.cil | 44 +++++++++++++------------ - udica/templates/net_container.cil | 32 +++++++++---------- - udica/templates/tmp_container.cil | 18 +++++------ - udica/templates/tty_container.cil | 13 ++++---- - udica/templates/virt_container.cil | 20 ++++++------ - udica/templates/x_container.cil | 30 ++++++++--------- - 8 files changed, 120 insertions(+), 118 deletions(-) - -diff --git a/udica/templates/config_container.cil b/udica/templates/config_container.cil -index abd2c0e..6014f90 100644 ---- a/udica/templates/config_container.cil -+++ b/udica/templates/config_container.cil -@@ -1,25 +1,24 @@ - (block config_container -- (blockinherit container) -- -- (allow process configfile (dir (ioctl read getattr lock search open))) -- (allow process configfile (file (ioctl read getattr lock open))) -- (allow process configfile (lnk_file (read getattr))) -- -+ (optional config_container_optional -+ (allow process configfile (dir (ioctl read getattr lock search open))) -+ (allow process configfile (file (ioctl read getattr lock open))) -+ (allow process configfile (lnk_file (read getattr))) -+ ) - ) - - (block config_rw_container -- (blockinherit config_container) -- -- (allow process configfile (dir (ioctl read write getattr lock append open))) -- (allow process configfile (file (ioctl read write getattr lock append open))) -- (allow process configfile (lnk_file (ioctl read write getattr lock append open))) -+ (blockinherit config_container) -+ (optional config_rw_container_optional -+ (allow process configfile (dir (ioctl read write getattr lock append open))) -+ (allow process configfile (file (ioctl read write getattr lock append open))) -+ (allow process configfile (lnk_file (ioctl read write getattr lock append open))) -+ ) - ) - - (block config_manage_container -- (blockinherit container) -- -- (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -- (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -- (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) -- -+ (optional config_manage_container_optional -+ (allow process configfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -+ (allow process configfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ (allow process configfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ ) - ) -diff --git a/udica/templates/home_container.cil b/udica/templates/home_container.cil -index 2683606..33499bc 100644 ---- a/udica/templates/home_container.cil -+++ b/udica/templates/home_container.cil -@@ -1,33 +1,37 @@ - (block home_container -- (blockinherit container) -+ (optional home_container_optional -+ (allow process process (capability (dac_override ))) - -- (allow process process (capability (dac_override ))) -+ (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) -+ (allow process home_root_t (dir (getattr search open read lock ioctl))) -+ (allow process user_home_t (dir (getattr search open read lock ioctl))) - -- (allow process user_home_dir_t (dir (getattr search open read lock ioctl))) -- (allow process home_root_t (dir (getattr search open read lock ioctl))) -- (allow process user_home_t (dir (getattr search open read lock ioctl))) -- -- (allow process user_home_dir_t (file (getattr ioctl lock open read))) -- (allow process user_home_t (file (getattr ioctl lock open read))) -+ (allow process user_home_dir_t (file (getattr ioctl lock open read))) -+ (allow process user_home_t (file (getattr ioctl lock open read))) -+ ) - ) - - - (block home_rw_container -- (blockinherit home_container) -- (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -- -- (allow process user_home_t (file (open getattr read write append ioctl lock))) -- (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) -+ (blockinherit home_container) -+ (optional home_rw_container_optional -+ (allow process user_home_dir_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ (allow process home_root_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ (allow process user_home_t (dir (open getattr setattr read write link search add_name remove_name reparent lock ioctl))) -+ -+ (allow process user_home_t (file (open getattr read write append ioctl lock))) -+ (allow process user_home_dir_t (file (open getattr read write append ioctl lock))) -+ ) - ) - - (block home_manage_container -- (blockinherit home_rw_container) -- (allow process user_home_dir_t (dir (create unlink rename rmdir ))) -- (allow process home_root_t (dir (create unlink rename rmdir ))) -- (allow process user_home_t (dir (create unlink rename rmdir ))) -- -- (allow process user_home_t (file (create rename link unlink ))) -- (allow process user_home_dir_t (file (create rename link unlink ))) -+ (blockinherit home_rw_container) -+ (optional home_manage_container_optional -+ (allow process user_home_dir_t (dir (create unlink rename rmdir ))) -+ (allow process home_root_t (dir (create unlink rename rmdir ))) -+ (allow process user_home_t (dir (create unlink rename rmdir ))) -+ -+ (allow process user_home_t (file (create rename link unlink ))) -+ (allow process user_home_dir_t (file (create rename link unlink ))) -+ ) - ) -diff --git a/udica/templates/log_container.cil b/udica/templates/log_container.cil -index 767c669..a5ecf45 100644 ---- a/udica/templates/log_container.cil -+++ b/udica/templates/log_container.cil -@@ -1,31 +1,35 @@ - (block log_container -- (blockinherit container) -- -- (allow process var_t (dir (getattr search open))) -- (allow process logfile (dir (ioctl read getattr lock search open))) -- (allow process logfile (file (ioctl read getattr lock open map))) -- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ (optional log_container_optional -+ (allow process var_t (dir (getattr search open))) -+ (allow process logfile (dir (ioctl read getattr lock search open))) -+ (allow process logfile (file (ioctl read getattr lock open map))) -+ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ ) - ) - - - (block log_rw_container -- (blockinherit log_container) -+ (blockinherit log_container) - -- (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) -- (allow process logfile (file (ioctl read write create getattr setattr lock append open))) -- (allow process logfile (lnk_file (ioctl read write getattr lock append open))) -- (allow process var_t (dir (getattr search open))) -- (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ (optional log_rw_container_optional -+ (allow process logfile (dir (ioctl read write create getattr setattr lock add_name search open))) -+ (allow process logfile (file (ioctl read write create getattr setattr lock append open))) -+ (allow process logfile (lnk_file (ioctl read write getattr lock append open))) -+ (allow process var_t (dir (getattr search open))) -+ (allow process auditd_log_t (dir (ioctl read getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read getattr lock open))) -+ ) - ) - - (block log_manage_container -- (blockinherit log_rw_container) -+ (blockinherit log_rw_container) - -- (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -- (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -- (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) -- (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) -- (allow process auditd_log_t (file (ioctl read write getattr lock open))) -+ (optional log_manage_container_optional -+ (allow process logfile (dir (ioctl read write create getattr setattr lock unlink link rename add_name remove_name reparent search rmdir open))) -+ (allow process logfile (file (ioctl read write create getattr setattr lock append unlink link rename open))) -+ (allow process logfile (lnk_file (ioctl read write create getattr setattr lock append unlink link rename))) -+ (allow process auditd_log_t (dir (ioctl read write getattr lock search open))) -+ (allow process auditd_log_t (file (ioctl read write getattr lock open))) -+ ) - ) -diff --git a/udica/templates/net_container.cil b/udica/templates/net_container.cil -index f839ed3..a89d548 100644 ---- a/udica/templates/net_container.cil -+++ b/udica/templates/net_container.cil -@@ -1,25 +1,25 @@ - (block net_container -- (blockinherit container) -- (typeattributeset sandbox_net_domain (process)) -+ (optional net_container_optional -+ (typeattributeset sandbox_net_domain (process)) -+ ) - ) - - (block restricted_net_container -- (blockinherit container) -+ (optional restricted_net_container_optional -+ (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) -+ (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -+ (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) - -- (allow process process (tcp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create listen accept))) -- (allow process process (udp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -- (allow process process (sctp_socket (ioctl read getattr lock write setattr append bind connect getopt setopt shutdown create))) -+ (allow process proc_t (lnk_file (read))) - -- (allow process proc_t (lnk_file (read))) -+ (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) -+ (allow process node_t (node (udp_recv recvfrom))) -+ (allow process node_t (node (udp_send sendto))) - -- (allow process node_t (node (tcp_recv tcp_send recvfrom sendto))) -- (allow process node_t (node (udp_recv recvfrom))) -- (allow process node_t (node (udp_send sendto))) -+ (allow process node_t (udp_socket (node_bind))) -+ (allow process node_t (tcp_socket (node_bind))) - -- (allow process node_t (udp_socket (node_bind))) -- (allow process node_t (tcp_socket (node_bind))) -- -- (allow process http_port_t (tcp_socket (name_connect))) -- (allow process http_port_t (tcp_socket (recv_msg send_msg))) -+ (allow process http_port_t (tcp_socket (name_connect))) -+ (allow process http_port_t (tcp_socket (recv_msg send_msg))) -+ ) - ) -- -diff --git a/udica/templates/tmp_container.cil b/udica/templates/tmp_container.cil -index 3b3e940..c2a899b 100644 ---- a/udica/templates/tmp_container.cil -+++ b/udica/templates/tmp_container.cil -@@ -1,15 +1,15 @@ - (block tmp_container -- (blockinherit container) -- -- (allow process tmpfile (dir (getattr search open))) -- (allow process tmpfile (file (ioctl read getattr lock open))) -- -+ (optional tmp_container_optional -+ (allow process tmpfile (dir (getattr search open))) -+ (allow process tmpfile (file (ioctl read getattr lock open))) -+ ) - ) - - (block tmp_rw_container -- (blockinherit tmp_container) -- -- (allow process tmpfile (file (ioctl read write getattr lock append open))) -- (allow process tmpfile (dir (ioctl read write getattr lock append open))) -+ (blockinherit tmp_container) - -+ (optional tmp_rw_container_optional -+ (allow process tmpfile (file (ioctl read write getattr lock append open))) -+ (allow process tmpfile (dir (ioctl read write getattr lock append open))) -+ ) - ) -diff --git a/udica/templates/tty_container.cil b/udica/templates/tty_container.cil -index 444b5f8..7a5522e 100644 ---- a/udica/templates/tty_container.cil -+++ b/udica/templates/tty_container.cil -@@ -1,10 +1,9 @@ - (block tty_container -- (blockinherit container) -+ (optional tty_container_optional -+ (allow process device_t (dir (getattr search open))) -+ (allow process device_t (dir (ioctl read getattr lock search open))) -+ (allow process device_t (lnk_file (read getattr))) - -- (allow process device_t (dir (getattr search open))) -- (allow process device_t (dir (ioctl read getattr lock search open))) -- (allow process device_t (lnk_file (read getattr))) -- -- (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) -+ (allow process devtty_t (chr_file (ioctl read write getattr lock append open))) -+ ) - ) -- -diff --git a/udica/templates/virt_container.cil b/udica/templates/virt_container.cil -index 8ecae54..0728eba 100644 ---- a/udica/templates/virt_container.cil -+++ b/udica/templates/virt_container.cil -@@ -1,16 +1,14 @@ - (block virt_container -- (blockinherit container) -+ (optional virt_container_optional -+ (allow process var_t (dir (getattr search open))) -+ (allow process var_t (lnk_file (read getattr))) - -- (allow process var_t (dir (getattr search open))) -- (allow process var_t (lnk_file (read getattr))) -+ (allow process var_run_t (dir (getattr search open))) -+ (allow process var_run_t (lnk_file (read getattr))) - -- (allow process var_run_t (dir (getattr search open))) -- (allow process var_run_t (lnk_file (read getattr))) -- -- (allow process virt_var_run_t (dir (getattr search open))) -- (allow process virt_var_run_t (sock_file (write getattr append open))) -- -- (allow process virtd_t (unix_stream_socket (connectto))) -+ (allow process virt_var_run_t (dir (getattr search open))) -+ (allow process virt_var_run_t (sock_file (write getattr append open))) - -+ (allow process virtd_t (unix_stream_socket (connectto))) -+ ) - ) -- -diff --git a/udica/templates/x_container.cil b/udica/templates/x_container.cil -index ee7441e..0a6ddb9 100644 ---- a/udica/templates/x_container.cil -+++ b/udica/templates/x_container.cil -@@ -1,27 +1,25 @@ - (block x_container -- (blockinherit container) -+ (optional x_container_optional -+ (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) - -- (allow xserver_t process (shm (getattr read write associate unix_read unix_write lock))) -+ (allow process xserver_t (unix_stream_socket (connectto))) - -- (allow process xserver_t (unix_stream_socket (connectto))) -+ (allow process device_t (dir (getattr search open))) - -- (allow process device_t (dir (getattr search open))) -+ (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) - -- (allow process dri_device_t (chr_file (ioctl read write getattr lock append open map))) -+ (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) - -- (allow process xserver_misc_device_t (chr_file (ioctl read write getattr lock append open map))) -+ (allow process urandom_device_t (chr_file (open read))) - -- (allow process urandom_device_t (chr_file (open read))) -+ (allow process tmpfs_t (dir (getattr search open))) - -- (allow process tmpfs_t (dir (getattr search open))) -+ (allow process tmp_t (dir (getattr search open))) -+ (allow process tmp_t (lnk_file (read getattr))) - -- (allow process tmp_t (dir (getattr search open))) -- (allow process tmp_t (lnk_file (read getattr))) -- -- (allow process xserver_tmp_t (dir (getattr search open))) -- (allow process xserver_tmp_t (sock_file (write getattr append open))) -- -- (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) -+ (allow process xserver_tmp_t (dir (getattr search open))) -+ (allow process xserver_tmp_t (sock_file (write getattr append open))) - -+ (allow process xserver_exec_t (file (ioctl read getattr lock map execute execute_no_trans open))) -+ ) - ) -- --- -2.30.2 - diff --git a/sources b/sources index c04350e..b0e6d67 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (v0.2.5.tar.gz) = 6321442ea546a630e08d3dd007bab153e47e15dce821eb824a899b239aa9e00d0edc3a239d3da1c4161afc72147f20d372e34a399a195a4b4ade12049b10df57 +SHA512 (v0.2.6.tar.gz) = 29295c9d95ecb15aed7e226d92a0b838046cf607e98956c66a83ad0f4ddf58b255586c24d407216ae9ddf5b11f502ae2b3a6822208d8dc8141124e68dac19265 diff --git a/udica.spec b/udica.spec index c72c842..aa0c726 100644 --- a/udica.spec +++ b/udica.spec @@ -1,9 +1,8 @@ Summary: A tool for generating SELinux security policies for containers Name: udica -Version: 0.2.5 +Version: 0.2.6 Release: 1%{?dist} Source0: https://github.com/containers/udica/archive/v%{version}.tar.gz -Patch001: 0001-Update-templates-to-work-properly-with-new-cil-parse.patch License: GPLv3+ BuildArch: noarch Url: https://github.com/containers/udica @@ -14,6 +13,8 @@ Requires: python3 python3-libsemanage python3-libselinux BuildRequires: python2 python2-devel python2-setuptools Requires: python2 libsemanage-python libselinux-python %endif +# container-selinux provides policy templates +Requires: container-selinux >= 2.168.0-2 %description Tool for generating SELinux security profiles for containers based on @@ -30,8 +31,6 @@ inspection of container JSON file. %endif %install -install --directory %%{buildroot}%{_datadir}/udica/templates - %if 0%{?fedora} || 0%{?rhel} > 7 %{__python3} setup.py install --single-version-externally-managed --root=%{buildroot} %else @@ -46,9 +45,7 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %{_bindir}/udica %dir %{_datadir}/udica %dir %{_datadir}/udica/ansible -%dir %{_datadir}/udica/templates %{_datadir}/udica/ansible/* -%{_datadir}/udica/templates/* %if 0%{?fedora} || 0%{?rhel} > 7 %license LICENSE @@ -61,6 +58,10 @@ install -m 0644 udica/man/man8/udica.8 %{buildroot}%{_mandir}/man8/udica.8 %endif %changelog +* Mon Sep 13 2021 Vit Mojzis - 0.2.6-1 +- New release https://github.com/containers/udica/releases/tag/v0.2.6 +- Move policy templates to container-selinux repo + * Wed Aug 25 2021 Vit Mojzis - 0.2.5-1 - New rebase https://github.com/containers/udica/releases/tag/v0.2.5 - Replace capability dictionary with str.lower()