From mboxrd@z Thu Jan 1 00:00:00 1970
Return-Path: <gentoo-commits+bounces-1486295-garchives=archives.gentoo.org@lists.gentoo.org>
Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits))
(No client certificate requested)
by finch.gentoo.org (Postfix) with ESMTPS id 4B2AB15800F
for <garchives@archives.gentoo.org>; Mon, 13 Feb 2023 15:35:36 +0000 (UTC)
Received: from pigeon.gentoo.org (localhost [127.0.0.1])
by pigeon.gentoo.org (Postfix) with SMTP id 0073CE0857;
Mon, 13 Feb 2023 15:35:33 +0000 (UTC)
Received: from smtp.gentoo.org (woodpecker.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits))
(No client certificate requested)
by pigeon.gentoo.org (Postfix) with ESMTPS id D4CB1E0855
for <gentoo-commits@lists.gentoo.org>; Mon, 13 Feb 2023 15:35:32 +0000 (UTC)
Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (4096 bits))
(No client certificate requested)
by smtp.gentoo.org (Postfix) with ESMTPS id 18A9733BEAC
for <gentoo-commits@lists.gentoo.org>; Mon, 13 Feb 2023 15:35:32 +0000 (UTC)
Received: from localhost.localdomain (localhost [IPv6:::1])
by oystercatcher.gentoo.org (Postfix) with ESMTP id 52B718C8
for <gentoo-commits@lists.gentoo.org>; Mon, 13 Feb 2023 15:35:28 +0000 (UTC)
From: "Kenton Groombridge" <concord@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Reply-To: gentoo-dev@lists.gentoo.org, "Kenton Groombridge" <concord@gentoo.org>
Message-ID: <1676301851.c891d981f2fd465d682c8129865613927308c30e.concord@gentoo>
Subject: [gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/services/
X-VCS-Repository: proj/hardened-refpolicy
X-VCS-Files: policy/modules/services/container.fc policy/modules/services/container.te
X-VCS-Directories: policy/modules/services/
X-VCS-Committer: concord
X-VCS-Committer-Name: Kenton Groombridge
X-VCS-Revision: c891d981f2fd465d682c8129865613927308c30e
X-VCS-Branch: master
Date: Mon, 13 Feb 2023 15:35:28 +0000 (UTC)
Precedence: bulk
List-Post: <mailto:gentoo-commits@lists.gentoo.org>
List-Help: <mailto:gentoo-commits+help@lists.gentoo.org>
List-Unsubscribe: <mailto:gentoo-commits+unsubscribe@lists.gentoo.org>
List-Subscribe: <mailto:gentoo-commits+subscribe@lists.gentoo.org>
List-Id: Gentoo Linux mail <gentoo-commits.gentoo.org>
X-BeenThere: gentoo-commits@lists.gentoo.org
X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply
X-Archives-Salt: b7ad968d-f394-4cf7-8985-3ad3d93b67bf
X-Archives-Hash: 029d4dea36753f6f9107a555e157971b
commit: c891d981f2fd465d682c8129865613927308c30e
Author: Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Fri Feb 10 18:30:56 2023 +0000
Commit: Kenton Groombridge <concord <AT> gentoo <DOT> org>
CommitDate: Mon Feb 13 15:24:11 2023 +0000
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=c891d981
container: add missing filetrans and filecon for containerd/docker
Add a missing file transition for the docker socket in /run as well as a
missing file context for /var/log/containerd.
Thanks-to: zen_desu
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Kenton Groombridge <concord <AT> gentoo.org>
policy/modules/services/container.fc | 1 +
policy/modules/services/container.te | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/policy/modules/services/container.fc b/policy/modules/services/container.fc
index 29a02b1d3..056aa6023 100644
--- a/policy/modules/services/container.fc
+++ b/policy/modules/services/container.fc
@@ -100,6 +100,7 @@ HOME_DIR/\.docker(/.*)? gen_context(system_u:object_r:container_conf_home_t,s0)
/var/lib/etcd(/.*)? gen_context(system_u:object_r:container_file_t,s0)
/var/lib/kube-proxy(/.*)? gen_context(system_u:object_r:container_file_t,s0)
+/var/log/containerd(/.*)? gen_context(system_u:object_r:container_log_t,s0)
/var/log/containers(/.*)? gen_context(system_u:object_r:container_log_t,s0)
/var/log/crio(/.*)? gen_context(system_u:object_r:container_log_t,s0)
/var/log/pods(/.*)? gen_context(system_u:object_r:container_log_t,s0)
diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te
index 534d6f4c5..15d1e8c88 100644
--- a/policy/modules/services/container.te
+++ b/policy/modules/services/container.te
@@ -747,7 +747,7 @@ allow container_engine_system_domain container_runtime_t:file { manage_file_perm
allow container_engine_system_domain container_runtime_t:fifo_file { manage_fifo_file_perms relabel_fifo_file_perms };
allow container_engine_system_domain container_runtime_t:lnk_file { manage_lnk_file_perms relabel_lnk_file_perms };
allow container_engine_system_domain container_runtime_t:sock_file { manage_sock_file_perms relabel_sock_file_perms };
-files_runtime_filetrans(container_engine_system_domain, container_runtime_t, { dir file })
+files_runtime_filetrans(container_engine_system_domain, container_runtime_t, { dir file sock_file })
allow container_engine_system_domain container_engine_cache_t:dir manage_dir_perms;
allow container_engine_system_domain container_engine_cache_t:file manage_file_perms;