Skip to content

Commit

Permalink
add selinux modification
Browse files Browse the repository at this point in the history
  • Loading branch information
karuboniru committed Jan 24, 2024
1 parent 88b3d7d commit b42cd4e
Show file tree
Hide file tree
Showing 9 changed files with 113 additions and 0 deletions.
25 changes: 25 additions & 0 deletions cils/adguardhome.cil
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
(block adguardhome
(blockinherit container)
(blockinherit restricted_net_container)
(allow process process ( capability ( net_bind_service )))

(allow process dns_port_t ( tcp_socket ( name_bind )))
(allow process dns_port_t ( udp_socket ( name_bind )))
(allow process dhcpd_port_t ( udp_socket ( name_bind )))
(allow process dhcpc_port_t ( udp_socket ( name_bind )))
(allow process http_port_t ( tcp_socket ( name_bind )))
(allow process http_port_t ( tcp_socket ( name_bind )))
(allow process reserved_port_t ( udp_socket ( name_bind )))
(allow process hi_reserved_port_t ( udp_socket ( name_bind )))
(allow process ntop_port_t ( tcp_socket ( name_bind )))
(allow process ntop_port_t ( udp_socket ( name_bind )))
(allow process unreserved_port_t ( tcp_socket ( name_bind )))
(allow process unreserved_port_t ( udp_socket ( name_bind )))

(allow process port_type ( tcp_socket ( name_connect recv_msg send_msg )))
(allow process port_type ( udp_socket ( recv_msg send_msg )))

(allow process cert_t ( dir ( watch getattr open read search )))
(allow process cert_t ( file ( watch getattr open read )))
(allow process cert_t ( lnk_file ( read )))
)
11 changes: 11 additions & 0 deletions cils/cloudflare_with_socket_access.cil
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
(block cloudflare_with_socket_access
(blockinherit container)
(blockinherit net_container)

(allow process node_t ( icmp_socket ( node_bind )))

(allow process var_run_t ( sock_file ( write )))
(allow process comiclib.process ( unix_stream_socket ( connectto )))
(allow process cockpit_ws_t ( unix_stream_socket ( connectto )))
(allow process container_caddy.process ( unix_stream_socket ( connectto )))
)
7 changes: 7 additions & 0 deletions cils/comiclib.cil
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
(block comiclib
(blockinherit container)


(allow process user_home_t ( dir ( watch getattr ioctl lock open read search )))
(allow process user_home_t ( file ( watch getattr ioctl lock open read )))
)
11 changes: 11 additions & 0 deletions cils/container_caddy.cil
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
(block container_caddy
(blockinherit container)
(blockinherit net_container)
(allow process process ( capability ( net_bind_service )))

(allow process user_home_t ( dir ( watch getattr ioctl lock open read search )))
(allow process user_home_t ( file ( watch getattr ioctl lock open read )))

(allow process var_run_t ( sock_file ( write )))
(allow process cockpit_ws_t ( unix_stream_socket ( connectto )))
)
14 changes: 14 additions & 0 deletions cils/container_hath.cil
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
(block container_hath
(blockinherit container)
(blockinherit restricted_net_container)
(allow process process ( capability ( net_bind_service )))

(allow process port_type ( tcp_socket ( name_connect recv_msg send_msg )))
(allow process port_type ( udp_socket ( recv_msg send_msg )))

(allow process http_port_t ( tcp_socket ( name_bind )))

(allow process user_home_t ( dir ( watch add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process user_home_t ( file ( watch append create getattr ioctl lock map open read rename setattr unlink write )))

)
7 changes: 7 additions & 0 deletions cils/container_rohome_allbind.cil
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
(block container_rohome_allbind
(blockinherit container)
(blockinherit net_container)

(allow process user_home_t ( dir ( watch getattr ioctl lock open read search )))
(allow process user_home_t ( file ( watch getattr ioctl lock open read )))
)
7 changes: 7 additions & 0 deletions cils/container_rwhome_allbind.cil
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
(block container_rwhome_allbind
(blockinherit container)
(blockinherit net_container)

(allow process user_home_t ( dir ( watch add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process user_home_t ( file ( watch append create getattr ioctl lock map open read rename setattr unlink write )))
)
7 changes: 7 additions & 0 deletions cils/container_wireguard.cil
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
(block container_wireguard
(blockinherit container)
(allow process process ( capability ( net_admin )))

(allow process container_wireguard.process ( netlink_route_socket ( nlmsg_write )))

)
24 changes: 24 additions & 0 deletions server.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -220,3 +220,27 @@ postprocess:
echo "root" | passwd --stdin root
mkdir -p /etc/ssh/sshd_config.d
echo "PasswordAuthentication no" > /etc/ssh/sshd_config.d/99-password-authentication.conf
fcontext -a -f a -t user_home_t -r 's0' '/media/storage(/.*)?'
semodule -i /etc/cils/*.cil /usr/share/udica/templates/{base_container.cil,net_container.cil}
rm -rf /etc/cils
add-files:
[
["cils/adguardhome.cil", "/etc/cils/adguardhome.cil"],
[
"cils/cloudflare_with_socket_access.cil",
"/etc/cils/cloudflare_with_socket_access.cil",
],
["cils/comiclib.cil", "/etc/cils/comiclib.cil"],
["cils/container_caddy.cil", "/etc/cils/container_caddy.cil"],
["cils/container_hath.cil", "/etc/cils/container_hath.cil"],
[
"cils/container_rohome_allbind.cil",
"/etc/cils/container_rohome_allbind.cil",
],
[
"cils/container_rwhome_allbind.cil",
"/etc/cils/container_rwhome_allbind.cil",
],
["cils/container_wireguard.cil", "/etc/cils/container_wireguard.cil"],
]

0 comments on commit b42cd4e

Please sign in to comment.