Sync from SUSE:SLFO:Main container-selinux revision b2ce930bdae6951023eee4f9d611100c
This commit is contained in:
commit
e53b68e7f3
23
.gitattributes
vendored
Normal file
23
.gitattributes
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
## Default LFS
|
||||
*.7z filter=lfs diff=lfs merge=lfs -text
|
||||
*.bsp filter=lfs diff=lfs merge=lfs -text
|
||||
*.bz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.gem filter=lfs diff=lfs merge=lfs -text
|
||||
*.gz filter=lfs diff=lfs merge=lfs -text
|
||||
*.jar filter=lfs diff=lfs merge=lfs -text
|
||||
*.lz filter=lfs diff=lfs merge=lfs -text
|
||||
*.lzma filter=lfs diff=lfs merge=lfs -text
|
||||
*.obscpio filter=lfs diff=lfs merge=lfs -text
|
||||
*.oxt filter=lfs diff=lfs merge=lfs -text
|
||||
*.pdf filter=lfs diff=lfs merge=lfs -text
|
||||
*.png filter=lfs diff=lfs merge=lfs -text
|
||||
*.rpm filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz filter=lfs diff=lfs merge=lfs -text
|
||||
*.tbz2 filter=lfs diff=lfs merge=lfs -text
|
||||
*.tgz filter=lfs diff=lfs merge=lfs -text
|
||||
*.ttf filter=lfs diff=lfs merge=lfs -text
|
||||
*.txz filter=lfs diff=lfs merge=lfs -text
|
||||
*.whl filter=lfs diff=lfs merge=lfs -text
|
||||
*.xz filter=lfs diff=lfs merge=lfs -text
|
||||
*.zip filter=lfs diff=lfs merge=lfs -text
|
||||
*.zst filter=lfs diff=lfs merge=lfs -text
|
||||
187
container-selinux.changes
Normal file
187
container-selinux.changes
Normal file
@ -0,0 +1,187 @@
|
||||
-------------------------------------------------------------------
|
||||
Mon Apr 24 07:24:46 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Update to version 2.211.0:
|
||||
* Don't transition to initrc_t domains from spc_t
|
||||
* Add tunable to allow sshd_t to launch container engines
|
||||
* Allow syslogd_t gettatr on inheritited runtime tmpfs files
|
||||
* Add container_file_t and container_ro_file_t as user_home_type
|
||||
* Set default context for local-path-provisioner
|
||||
* Allow daemon to send dbus messages to spc_t by
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Mar 29 13:04:36 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Update to version 2.206.0:
|
||||
* Allow unconfined domains to transition to container_runtime_t
|
||||
* Allow container domains to transition to install_t
|
||||
* Allow avirt_sandbox_domain to manage container_file_t types
|
||||
* Allow containers to watch sysfs_t directories
|
||||
* Allow spc_t to transption to rpm_script_t
|
||||
* Add support to new user_namespace access check
|
||||
* Smaller permission changes for container_init_t
|
||||
- Drop spc.patch, is now included
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Jan 16 12:47:34 UTC 2023 - Frederic Crozat <fcrozat@suse.com>
|
||||
|
||||
- Update to version 2.198.0:
|
||||
* Fix spc_t transition rules on tmpfs_t
|
||||
- Changes from 2.197.0:
|
||||
* Add boolean containers_use_ecryptfs policy
|
||||
- Changes from 2.195.1:
|
||||
* Readd missing allow rules for container_t
|
||||
- Changes from 2.194.0:
|
||||
* Allow syslogd_t to use tmpfs files created by container runtime
|
||||
- Changes from 2.193.0:
|
||||
* Allow containers to mount tmpfs_t file systems
|
||||
* Label spc_t as a init initrc daemon
|
||||
* Allow userdomains to run containers
|
||||
- Changes from 2.191.0:
|
||||
* Create container_logwriter_t type
|
||||
- Changes from 2.190.1:
|
||||
* Support BuildKit
|
||||
* container.fc: Set label for kata-agent
|
||||
* support nerdctl
|
||||
- Changes from 2.190.0:
|
||||
* Packit: initial enablement
|
||||
* Allow iptables to list directories labeled as container_file_t
|
||||
- Changes from 2.189.0:
|
||||
* Dont audit searching other processes in /proc.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jan 12 13:02:32 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Rename spc_timedated.patch to spc.patch
|
||||
- Update spc.patch to allow privileged containers to use
|
||||
localectl (bsc#1207077)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jan 11 14:15:06 UTC 2023 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Add spc_timedated.patch to allow privileged containers to use
|
||||
timedatectl (bsc#1207054)
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Jul 14 08:37:48 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Update to version 2.188.0:
|
||||
* Allow confined containers to mount overlay filesystems
|
||||
Fixed bsc#1201348
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Jun 22 13:17:49 UTC 2022 - Frederic Crozat <fcrozat@suse.com>
|
||||
|
||||
- Update to version 2.187.0:
|
||||
* Allow container domains to use /dev/zero
|
||||
- Changes from 2.186.0:
|
||||
* Create policy for a container_device_t
|
||||
* Allow containers to shutdown & setopt userdomain:sockets
|
||||
- Changes from 2.183.0:
|
||||
* Allow containers to inherit all socket classes from container runtimes.
|
||||
- Changes from 2.182.0:
|
||||
* Allow containers to inherit all socket classes
|
||||
- Changes from 2.181.0:
|
||||
* Allow socket activated domains for tcp sockets from init_t and userdomains.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Mar 22 08:35:54 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Add udica templates to the package
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Mar 18 12:04:25 UTC 2022 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Update to version 2.180.0
|
||||
* Allow container domains to read/write kvm_device_t
|
||||
* Update kublet mappings to inlcude /usr/local/*
|
||||
* Allow container domains to use container runtime tcp and udp sockets
|
||||
* Alow containers to use unix_stream_sockets leaked from container runtimes
|
||||
* Allow userdomains to execute conmon_exec_t and use it as an entrypoint
|
||||
* Allow conmon_exec_t as an entrypoint
|
||||
* Add container_use_devices boolean to allow containers to use any device
|
||||
* Add explicit range transition for conmon
|
||||
* Add missing dbus class declaration into container_runtime_run()
|
||||
* Remove lockdown allow rules
|
||||
* Remove k3s fcontexts
|
||||
* Allow container domains to be used by user roles
|
||||
- Changed source url to allow for download via source service
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Nov 12 16:21:06 UTC 2021 - Richard Brown <rbrown@suse.com>
|
||||
|
||||
- Update to version 2.171.0
|
||||
* Define kubernetes_file_t as a config_type
|
||||
* Allow containers to be socket activated by user domains and by systemd.
|
||||
* Allow iptables to use fifo files of a container runtime
|
||||
* Allow container_runtime create all tmpfs content as container_runtime_tmpfs_t
|
||||
* Allow containers to create lnk_file on tmpfs_t directories.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 9 07:44:17 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Update to version 2.164.2
|
||||
* Don't setup users for writing to pid_sockets
|
||||
* Allow container engines to be started from the staff user.
|
||||
* Allow spc_t domains to set bpf rules on any domain
|
||||
* Add support for k3s
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Fri Apr 23 06:04:48 UTC 2021 - Johannes Segitz <jsegitz@suse.com>
|
||||
|
||||
- Fix container runtime binary labels (bsc#1185030). You need to
|
||||
relable at least /usr/sbin if you're affected
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Feb 23 13:21:19 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
- Update to version 2.158.0
|
||||
- Add nfs remount support
|
||||
- Allow containers to execmod on nfs, samba and cephs remote shares
|
||||
- Allow confined users to send dbus messages to container_runtime
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Jan 11 10:40:32 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
- Update to version 2.154.0
|
||||
- Allow confined user domains to run confined container domains.
|
||||
- Allow all containers to use nfs shares, iff virt_use_nfs boolean
|
||||
is enabled.
|
||||
- Allow containers to read nsfs file systems.
|
||||
- KVM Container need to use tunnel sockets created by runtime.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Tue Nov 3 07:53:35 UTC 2020 - Ludwig Nussel <lnussel@suse.de>
|
||||
|
||||
- Don't use BuildRequires based on shell script output. OBS can't
|
||||
evaluate that.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Thu Oct 29 07:52:21 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
- Update to version 2.150.0
|
||||
- Add additional allow rules for kvm based containers using
|
||||
virtiofsd.
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Oct 14 12:57:07 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
- Update to version 2.145.0
|
||||
- Add support for kubernetes_file_t
|
||||
- Allow container_t to open existing tun/tap
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Aug 12 09:11:30 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
- Minimize BuildRequires
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Mon Aug 10 21:11:12 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
- Update to version 2.143.0
|
||||
- support containerd/cri
|
||||
|
||||
-------------------------------------------------------------------
|
||||
Wed Aug 5 08:42:45 UTC 2020 - Thorsten Kukuk <kukuk@suse.com>
|
||||
|
||||
- Initial version
|
||||
104
container-selinux.spec
Normal file
104
container-selinux.spec
Normal file
@ -0,0 +1,104 @@
|
||||
#
|
||||
# spec file for package container-selinux
|
||||
#
|
||||
# Copyright (c) 2022 SUSE LLC
|
||||
#
|
||||
# All modifications and additions to the file contributed by third parties
|
||||
# remain the property of their copyright owners, unless otherwise agreed
|
||||
# upon. The license for this file, and modifications and additions to the
|
||||
# file, is the same license as for the pristine package itself (unless the
|
||||
# license for the pristine package is not an Open Source License, in which
|
||||
# case the license is the MIT License). An "Open Source License" is a
|
||||
# license that conforms to the Open Source Definition (Version 1.9)
|
||||
# published by the Open Source Initiative.
|
||||
|
||||
# Please submit bugfixes or comments via https://bugs.opensuse.org/
|
||||
#
|
||||
|
||||
|
||||
%global selinuxtype targeted
|
||||
%global moduletype services
|
||||
%global modulenames container
|
||||
# Usage: _format var format
|
||||
# Expand 'modulenames' into various formats as needed
|
||||
# Format must contain '$x' somewhere to do anything useful
|
||||
%global _format() export %{1}=""; for x in %{modulenames}; do %{1}+=%{2}; %{1}+=" "; done;
|
||||
# Version of SELinux we were using
|
||||
%define selinux_policyver %(rpm -q selinux-policy --qf '%%{version}')
|
||||
Name: container-selinux
|
||||
Version: 2.211.0
|
||||
Release: 0
|
||||
Summary: SELinux policies for container runtimes
|
||||
License: GPL-2.0-only
|
||||
URL: https://github.com/containers/container-selinux
|
||||
Source0: https://github.com/containers/container-selinux/archive/refs/tags/v%{version}.tar.gz
|
||||
BuildRequires: selinux-policy
|
||||
BuildRequires: selinux-policy-devel
|
||||
Requires: selinux-policy >= %(rpm -q selinux-policy --qf '%%{version}-%%{release}')
|
||||
Requires(post): policycoreutils
|
||||
Requires(post): /usr/bin/sed
|
||||
Requires(post): selinux-policy-base >= %{selinux_policyver}
|
||||
Requires(post): selinux-policy-targeted >= %{selinux_policyver}
|
||||
Requires(post): selinux-tools
|
||||
BuildArch: noarch
|
||||
|
||||
%description
|
||||
SELinux policy modules for use with container runtimes.
|
||||
|
||||
%prep
|
||||
%setup -q
|
||||
|
||||
%build
|
||||
%make_build
|
||||
|
||||
%install
|
||||
# install policy modules
|
||||
%_format MODULES $x.pp.bz2
|
||||
install -d %{buildroot}%{_datadir}/selinux/packages
|
||||
install -d -p %{buildroot}%{_datadir}/selinux/devel/include/services
|
||||
install -p -m 644 container.if %{buildroot}%{_datadir}/selinux/devel/include/services
|
||||
install -m 0644 $MODULES %{buildroot}%{_datadir}/selinux/packages
|
||||
install -d %{buildroot}/%{_datadir}/containers/selinux
|
||||
install -m 644 container_contexts %{buildroot}/%{_datadir}/containers/selinux/contexts
|
||||
install -d %{buildroot}%{_datadir}/udica/templates
|
||||
install -m 0644 udica-templates/*.cil %{buildroot}%{_datadir}/udica/templates
|
||||
|
||||
%check
|
||||
|
||||
%pre
|
||||
%selinux_relabel_pre -s %{selinuxtype}
|
||||
|
||||
%post
|
||||
# Install all modules in a single transaction
|
||||
if [ $1 -eq 1 ]; then
|
||||
%{_sbindir}/setsebool -P -N virt_use_nfs=1 virt_sandbox_use_all_caps=1
|
||||
fi
|
||||
%_format MODULES %{_datadir}/selinux/packages/$x.pp.bz2
|
||||
%{_sbindir}/semodule -n -s %{selinuxtype} -r container 2> /dev/null ||:
|
||||
%{_sbindir}/semodule -n -s %{selinuxtype} -d docker 2> /dev/null ||:
|
||||
%{_sbindir}/semodule -n -s %{selinuxtype} -d gear 2> /dev/null ||:
|
||||
%selinux_modules_install -s %{selinuxtype} $MODULES
|
||||
. %{_sysconfdir}/selinux/config
|
||||
sed -e "\|container_file_t|h; \${x;s|container_file_t||;{g;t};a\\" -e "container_file_t" -e "}" -i %{_sysconfdir}/selinux/${SELINUXTYPE}/contexts/customizable_types
|
||||
matchpathcon -qV %{_sharedstatedir}/containers || restorecon -R %{_sharedstatedir}/containers &> /dev/null || :
|
||||
|
||||
%postun
|
||||
if [ $1 -eq 0 ]; then
|
||||
%selinux_modules_uninstall -s %{selinuxtype} %{modulenames} docker
|
||||
fi
|
||||
|
||||
%posttrans
|
||||
%selinux_relabel_post -s %{selinuxtype}
|
||||
|
||||
%files
|
||||
%license LICENSE
|
||||
%doc README.md
|
||||
%{_datadir}/selinux/*
|
||||
%dir %{_datadir}/containers
|
||||
%dir %{_datadir}/containers/selinux
|
||||
%{_datadir}/containers/selinux/contexts
|
||||
%dir %{_datadir}/udica
|
||||
%dir %{_datadir}/udica/templates
|
||||
%{_datadir}/udica/templates/*
|
||||
|
||||
%changelog
|
||||
BIN
v2.211.0.tar.gz
(Stored with Git LFS)
Normal file
BIN
v2.211.0.tar.gz
(Stored with Git LFS)
Normal file
Binary file not shown.
Loading…
Reference in New Issue
Block a user