qm/qm.te at main · containers/qm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
policy_module(qm, 1.2)

gen_require(`
	attribute container_file_type;
	attribute container_runtime_domain;
	type init_t;
')

type ipc_t;
domain_type(ipc_t)
role system_r types ipc_t;
unconfined_domain_noaudit(ipc_t)

type ipc_exec_t;
application_executable_file(ipc_exec_t)
allow ipc_t { ipc_exec_t container_file_type}:file entrypoint;

init_system_domain(ipc_t, ipc_exec_t)
role system_r types ipc_t;
domtrans_pattern(container_runtime_domain, ipc_exec_t, ipc_t)

type ipc_var_run_t;
files_pid_file(ipc_var_run_t)
files_mountpoint(ipc_var_run_t)

files_pid_filetrans(ipc_t, ipc_var_run_t, { dir file lnk_file sock_file })
files_pid_filetrans(init_t, ipc_var_run_t, dir, "ipc")

unconfined_domain(ipc_t)

qm_domain_template(qm)

allow qm_t tmpfs_t:dir mounton;

allow qm_container_ipc_t ipc_var_run_t:dir { add_name remove_name write };
allow qm_container_ipc_t ipc_var_run_t:sock_file { create setattr unlink };
allow qm_container_ipc_t tmpfs_t:file { open map };


#########################################
#
# bluechi-agent inside QM
#

type qm_bluechi_agent_t;
type qm_bluechi_agent_exec_t;
init_daemon_domain(qm_bluechi_agent_t, qm_bluechi_agent_exec_t)

allow qm_bluechi_agent_t qm_file_t:chr_file read;
allow qm_bluechi_agent_t qm_file_t:dir { open read search getattr };
allow qm_bluechi_agent_t qm_file_t:file { execute getattr open read };
allow qm_bluechi_agent_t qm_file_t:file map;
allow qm_bluechi_agent_t qm_file_t:lnk_file read;
allow qm_bluechi_agent_t qm_file_t:sock_file write;
allow qm_bluechi_agent_t qm_t:unix_dgram_socket sendto;
allow qm_bluechi_agent_t qm_t:unix_stream_socket connectto;
allow qm_bluechi_agent_t self:unix_dgram_socket { create getopt setopt };
allow qm_bluechi_agent_t self:tcp_socket create_stream_socket_perms;

allow qm_bluechi_agent_t qm_t:dbus { send_msg acquire_svc };
allow qm_bluechi_agent_t qm_t:system status;
allow qm_bluechi_agent_t qm_t:system { reload start stop status };
allow qm_bluechi_agent_t qm_file_t:service { reload start stop status };

allow qm_t qm_bluechi_agent_t:dir search;
allow qm_t qm_bluechi_agent_t:file { getattr ioctl open read };
allow qm_t qm_bluechi_agent_t:lnk_file read;
allow qm_t qm_bluechi_agent_t:dbus send_msg;
allow qm_t qm_bluechi_agent_t:process { signull signal sigkill };

unconfined_server_stream_connectto(qm_bluechi_agent_t)

# Allow qm_bluechi_agent_t to connect to any port instead of labelled ones.
gen_tunable(qm_bluechi_agent_port_connect_any, true)

optional_policy(`
	require{
		type bluechi_var_run_t;
		type bluechi_agent_port_t;
		type bluechi_t;
	}

	tunable_policy(`qm_bluechi_agent_port_connect_any',`
		corenet_tcp_connect_all_ports(qm_bluechi_agent_t)
	',`
		allow qm_bluechi_agent_t bluechi_agent_port_t:tcp_socket name_connect;
	')

	stream_connect_pattern(qm_bluechi_agent_t, bluechi_var_run_t, bluechi_var_run_t, bluechi_t)
')