719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# SELinux policy for LXC for RHEL/CentOS/Oracle 6.5.
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# It attempts to restrict the container to the same amount of access
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# as an unprivileged user. To build and insert this policy module:
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# make -f /usr/share/selinux/devel/Makefile lxc.pp
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# In your container's lxc config:
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# lxc.se_context = system_u:system_r:lxc_t:s0:c62,c86,c150,c228
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# Ensure your container's rootfs files are labeled:
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# chcon -R system_u:object_r:lxc_file_t:s0:c62,c86,c150,c228 /path/to/rootfs
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# To keep containers separated from each other, you should vary the MCS
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# portion of the contexts above to be a unique set of values for each
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# container, each MCS compartment can be a number from 0-1023.
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenpolicy_module(lxc,0.35)
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenuserdom_unpriv_user_template(lxc)
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engentype lxc_file_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenfiles_type(lxc_file_t);
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenrole system_r types { lxc_t lxc_file_t };
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engengen_require(`
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen type devpts_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen type proc_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen type ssh_port_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen type sysctl_kernel_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen type sysctl_modprobe_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen type sysctl_net_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen type tmpfs_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen type unconfined_t;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen class filesystem { relabelfrom unmount };
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen class tcp_socket name_bind;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen class udp_socket name_bind;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# So lxc can transition to lxc_t on exec
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow unconfined_t lxc_t:process transition;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engencan_exec(lxc_t, lxc_file_t)
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# So lxc can dyntransition to lxc_t for attach executing a function
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow unconfined_t lxc_t:process dyntransition;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# So lxc-start can relabel the pty allocated for the console
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_file_t devpts_t:filesystem associate;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# So container can mount /dev/shm and relabel it
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t tmpfs_t:filesystem relabelfrom;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# Allow all access to an lxc_file_t type; devices can be restricted
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engen# with the device cgroup, they are not here
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:file *;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:lnk_file *;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:chr_file *;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:blk_file *;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:sock_file *;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:fifo_file *;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:socket *;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:dir *;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t lxc_file_t:filesystem unmount;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenfs_unmount_all_fs(lxc_t)
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t proc_t:dir mounton;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t proc_t:filesystem mount;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t tmpfs_t:filesystem mount;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t self:capability { dac_override dac_read_search fsetid ipc_lock net_admin net_bind_service net_broadcast net_raw sys_admin sys_boot sys_tty_config };
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t sysctl_net_t:file write;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t ssh_port_t:tcp_socket name_bind;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engencorenet_tcp_connect_all_ports(lxc_t)
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engencorenet_tcp_bind_all_ports(lxc_t)
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engencorenet_udp_bind_all_ports(lxc_t)
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t self:packet_socket create_socket_perms;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t self:rawip_socket create_socket_perms;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engenallow lxc_t self:netlink_route_socket create_netlink_socket_perms;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engendontaudit lxc_t sysctl_kernel_t:file write;
719fae07bf641ad6ed80b12c52f60b68d734f611Dwight Engendontaudit lxc_t sysctl_modprobe_t:file write;