Chapter 9. Creating SELinux policies for containers

1. Parsing the container spec file in the JSON format
2. Finding suitable allow rules based on the results of the first part
3. Generating final SELinux policy

Procedure

1. Install the udica package:

   # dnf install -y udica

   Copy to Clipboard Toggle word wrap

   Alternatively, install the container-tools module, which provides a set of container software packages, including udica:

   # dnf module install -y container-tools

   Copy to Clipboard Toggle word wrap

2. Start the ubi8 container that mounts the /home directory with read-only permissions and the /var/spool directory with permissions to read and write. The container exposes the port 21.

   # podman run --env container=podman -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash

   Copy to Clipboard Toggle word wrap

   Note that now the container runs with the container_t SELinux type. This type is a generic domain for all containers in the SELinux policy and it might be either too strict or too loose for your scenario.

3. Open a new terminal, and enter the podman ps command to obtain the ID of the container:

   # podman ps
   CONTAINER ID   IMAGE                                   COMMAND   CREATED          STATUS              PORTS   NAMES
   37a3635afb8f   registry.access.redhat.com/ubi8:latest  bash      15 minutes ago   Up 15 minutes ago           heuristic_lewin

   Copy to Clipboard Toggle word wrap

4. Create a container JSON file, and use udica for creating a policy module based on the information in the JSON file:

   # podman inspect 37a3635afb8f > container.json
   # udica -j container.json my_container
   Policy my_container with container id 37a3635afb8f created!
   […]

   Copy to Clipboard Toggle word wrap

   Alternatively:

   # podman inspect 37a3635afb8f | udica my_container
   Policy my_container with container id 37a3635afb8f created!
   
   Please load these modules using:
   # semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}
   
   Restart the container with: "--security-opt label=type:my_container.process" parameter

   Copy to Clipboard Toggle word wrap

5. As suggested by the output of udica in the previous step, load the policy module:

   # semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}

   Copy to Clipboard Toggle word wrap

6. Stop the container and start it again with the --security-opt label=type:my_container.process option:

   # podman stop 37a3635afb8f
   # podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash

   Copy to Clipboard Toggle word wrap

Verification

1. Check that the container runs with the my_container.process type:

   # ps -efZ | grep my_container.process
   unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 root 2275 434  1 13:49 pts/1 00:00:00 podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it ubi8 bash
   system_u:system_r:my_container.process:s0:c270,c963 root 2317 2305  0 13:49 pts/0 00:00:00 bash

   Copy to Clipboard Toggle word wrap

2. Verify that SELinux now allows access the /home and /var/spool mount points:

   [root@37a3635afb8f /]# cd /home
   [root@37a3635afb8f home]# ls
   username
   [root@37a3635afb8f ~]# cd /var/spool/
   [root@37a3635afb8f spool]# touch test
   [root@37a3635afb8f spool]#

   Copy to Clipboard Toggle word wrap

3. Check that SELinux allows binding only to the port 21:

   [root@37a3635afb8f /]# dnf install nmap-ncat
   [root@37a3635afb8f /]# nc -lvp 21
   …
   Ncat: Listening on :::21
   Ncat: Listening on 0.0.0.0:21
   ^C
   [root@37a3635afb8f /]# nc -lvp 80
   …
   Ncat: bind to :::80: Permission denied. QUITTING.

   Copy to Clipboard Toggle word wrap