feat: add selinux write and connectto to kine sock

Signed-off-by: Vitor Savian <[email protected]>
rancher · Oct 7, 2024 · 72fd664 · 72fd664
1 parent 3971a42
commit 72fd664
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 4 deletions.
diff --git a/policy/centos7/rke2.te b/policy/centos7/rke2.te
@@ -13,6 +13,8 @@ rke2_filetrans_named_content(unconfined_service_t)
 #######################
 rke2_service_domain_template(rke2_service)
 container_read_lib_files(rke2_service_t)
+allow rke2_service_t container_var_lib_t:sock_file { write };
+allow rke2_service_t container_runtime_t:unix_stream_socket { connectto };
 
 ##########################
 # type rke2_service_db_t #
@@ -38,4 +40,4 @@ allow iscsid_t self:capability dac_override;
 # type rke2_tls_t #
 ###################
 type rke2_tls_t;
-files_type(rke2_tls_t);
+files_type(rke2_tls_t);
diff --git a/policy/centos8/rke2.te b/policy/centos8/rke2.te
@@ -12,6 +12,8 @@ rke2_filetrans_named_content(unconfined_service_t)
 #######################
 rke2_service_domain_template(rke2_service)
 container_read_lib_files(rke2_service_t)
+allow rke2_service_t container_var_lib_t:sock_file { write };
+allow rke2_service_t container_runtime_t:unix_stream_socket { connectto };
 
 ##########################
 # type rke2_service_db_t #

diff --git a/policy/centos9/rke2.te b/policy/centos9/rke2.te
@@ -13,6 +13,8 @@ rke2_filetrans_named_content(unconfined_service_t)
 rke2_service_domain_template(rke2_service)
 container_read_lib_files(rke2_service_t)
 allow rke2_service_t container_var_lib_t:file { watch };
+allow rke2_service_t container_var_lib_t:sock_file { write };
+allow rke2_service_t container_runtime_t:unix_stream_socket { connectto };
 
 ##########################
 # type rke2_service_db_t #
@@ -32,4 +34,4 @@ allow iscsid_t self:capability dac_override;
 # type rke2_tls_t #
 ###################
 type rke2_tls_t;
-container_file(rke2_tls_t);
+container_file(rke2_tls_t);
diff --git a/policy/microos/rke2.te b/policy/microos/rke2.te
@@ -12,6 +12,8 @@ rke2_filetrans_named_content(unconfined_service_t)
 #######################
 rke2_service_domain_template(rke2_service)
 container_read_lib_files(rke2_service_t)
+allow rke2_service_t container_var_lib_t:sock_file { write };
+allow rke2_service_t container_runtime_t:unix_stream_socket { connectto };
 
 ##########################
 # type rke2_service_db_t #
@@ -31,4 +33,4 @@ allow iscsid_t self:capability dac_override;
 # type rke2_tls_t #
 ###################
 type rke2_tls_t;
-container_file(rke2_tls_t);
+container_file(rke2_tls_t);
diff --git a/policy/slemicro/rke2.te b/policy/slemicro/rke2.te
@@ -13,6 +13,8 @@ rke2_filetrans_named_content(unconfined_service_t)
 rke2_service_domain_template(rke2_service)
 container_read_lib_files(rke2_service_t)
 allow rke2_service_t container_var_lib_t:file { watch };
+allow rke2_service_t container_var_lib_t:sock_file { write };
+allow rke2_service_t container_runtime_t:unix_stream_socket { connectto };
 
 ##########################
 # type rke2_service_db_t #
@@ -32,4 +34,4 @@ allow iscsid_t self:capability dac_override;
 # type rke2_tls_t #
 ###################
 type rke2_tls_t;
-files_type(rke2_tls_t);
+files_type(rke2_tls_t);