Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow container domains to use container_runtime_tmpfs_t as an entryp… #279

Merged
merged 2 commits into from
Oct 10, 2023
Merged

Allow container domains to use container_runtime_tmpfs_t as an entryp… #279

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
56fe16a
Allow container domains to use container_runtime_tmpfs_t as an entryp…
rhatdan Oct 10, 2023
4b384f0
Allow container domains to ptrace themselves
rhatdan Oct 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions container.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -751,7 +751,7 @@ tunable_policy(`container_connect_any',`
#
# spc local policy
#
allow spc_t { container_file_t container_var_lib_t container_ro_file_t }:file entrypoint;
allow spc_t { container_file_t container_var_lib_t container_ro_file_t container_runtime_tmpfs_t}:file entrypoint;
role system_r types spc_t;

domtrans_pattern(container_runtime_domain, container_ro_file_t, spc_t)
Expand Down Expand Up @@ -884,7 +884,7 @@ container_manage_files_template(container, container)
typeattribute container_file_t container_file_type, user_home_type;
typeattribute container_t container_domain, container_net_domain, container_user_domain;
allow container_user_domain self:process getattr;
allow container_domain { container_var_lib_t container_ro_file_t container_file_t }:file entrypoint;
allow container_domain { container_var_lib_t container_ro_file_t container_file_t container_runtime_tmpfs_t}:file entrypoint;
allow container_runtime_domain container_domain:fifo_file rw_fifo_file_perms;
allow container_domain container_runtime_domain:fifo_file { rw_fifo_file_perms map };
allow container_domain container_runtime_t:unix_dgram_socket sendto;
Expand Down Expand Up @@ -1544,3 +1544,8 @@ allow container_domain fusefs_t:file { append create entrypoint execmod execute
corecmd_entrypoint_all_executables(container_kvm_t)
allow svirt_sandbox_domain exec_type:file { entrypoint execute execute_no_trans getattr ioctl lock map open read };
allow svirt_sandbox_domain mountpoint:file entrypoint;

tunable_policy(`deny_ptrace',`',`
allow container_domain self:process ptrace;
allow spc_t self:process ptrace;
')