Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: SELinux bring-up #9127

Draft
wants to merge 207 commits into
base: main
Choose a base branch
from
Draft

feat: SELinux bring-up #9127

wants to merge 207 commits into from
+2,794 −264

Conversation

dsseng
Copy link
Member

@dsseng dsseng commented Aug 7, 2024 •
edited
Loading

Pull Request

What? (description)

Initial SELinux support

Why? (reasoning)

Improve security, #8016

Acceptance

Please use the following checklist:

  • you linked an issue (if applicable)
  • you included tests (if applicable)
  • you ran conformance (make conformance)
  • you formatted your code (make fmt)
  • you linted your code (make lint)
  • you generated documentation (make docs)
  • you ran unit-tests (make unit-tests)

See make help for a description of the available targets.

Tip: to debug denials in QEMU:

secilc -c 33 selinux/**/*.cil -vvvvv && PYTHONPATH=/tmp/selinux/python/sepolgen/src python3 /tmp/selinux/python/audit2allow/audit2allow -i /tmp/tl-test-home/.talos/clusters/talos-default/talos-default-controlplane-1.log -C -p /tmp/talos/policy.33 > /tmp/audit2allow.cil && PYTHONPATH=/tmp/selinux/python/sepolgen/src python3 /tmp/selinux/python/audit2allow/audit2allow -i /tmp/tl-test-home/.talos/clusters/talos-default/talos-default-controlplane-1.log -C -p /tmp/talos/policy.33 -e > /tmp/audit2allow-explain.cil

@dsseng dsseng self-assigned this Aug 7, 2024
@dsseng dsseng force-pushed the selinux branch 2 times, most recently from ec1b0f7 to 80fbde2 Compare August 11, 2024 19:31
@dsseng
feat: machined: bring up SELinux
1db0baf 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
feat: machined: allow running system containers with SELinux
5e4db91 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
continue: selinux labels for containerd runner
a8d9d35 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
labels for containerd-running services
c2bbfeb 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
feat: selinux: basic CIL policy
31adc85 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
more classes
5d33c21 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
fs support
45ec661 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
add dashboard policy parts
d5d9a2f 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
feat: wrapperd: support setting SELinux labels
595b795 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
feat: assign SELinux labels to containerd instances
1fb3b61 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
feat: etcd SELinux label
45c8848 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
feat: selinux: transitions
6c1c091 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
chore: selinux: remove placeholders
2d39f5a 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
allow transitions for executables
5307780 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
minor sidorder format
757c652 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
DEBUG: add CIL files to rootfs
47681d5 
Just to make sure we use proper version

Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
more sids, matching refpolicy
164498c 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
etcd in client space
b70a5fe 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
label misc pseudo-filesystems
7dffea2 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
rootfs genfscon format
4b6b5fc 
Signed-off-by: Dmitry Sharshakov <[email protected]>
@dsseng
label udevadm symlink
a0fb91f 
Signed-off-by: Dmitry Sharshakov <[email protected]>
dsseng and others added 20 commits September 2, 2024 21:49
@dsseng
fixup! fix: containerd: only set label when running with SELinux
46819f3
@dsseng
fixup! fix: containerd: only set label when running with SELinux
7f2ec84
@dsseng
chore: make CI preserve logs on success
8e12b84
@dsseng
fixup! relabel FS's
5603b18
@dsseng
fixup! relabel FS's
3c4304b
@dsseng
Merge branch 'main' into selinux
5758891 
 Conflicts:
	.github/workflows/ci.yaml
	.github/workflows/integration-image-factory-cron.yaml
	.github/workflows/integration-qemu-cron.yaml
	.github/workflows/integration-qemu-encrypted-vip-cron.yaml
	pkg/machinery/api/resource/definitions/block/block.pb.go
@dsseng
sids: allow unlabeled_t as a file label
f44f533
@dsseng
chore: build: optimize SELinux policy on CIL compile
35e81f4
@dsseng
cri, system-containerd: ensure tmpfs (and runc_cloned) contexts
71f318d
@dsseng
Merge branch 'main' into selinux
d07d67f
@dsseng
fix: permissions for installer
d9fd30d
@dsseng
fix: selinux policy for CNI components
987f210
@dsseng
HACK: fix containerd memfds
67c1051
@dsseng
fix: allow fs_t getattr
e4ed692
@dsseng
Merge branch 'main' into selinux
e9adfcf
@dsseng
fixup! installer permissions
5d3b12c
@dsseng
fixup! cri containerd hack
a42db75
@dsseng
se: generalize unix_stream_socket
1ee149c
@dsseng
se: misc todos in classes
4715785
@dsseng
net: allow any process to access IB
2457f4a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees

@dsseng dsseng

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@dsseng