diff options
| author |   Kenton Groombridge <concord@gentoo.org> | 2024-08-07 16:54:09 -0400 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2024-09-21 15:28:29 -0700 |
| commit | d15a97c13a82e5a4ba930f2fd5e823bbef3ce0da (patch) | |
| tree | 6e003f7b51ae6a19c6d6bdca1f192082f9f91e56 | |
| parent | kubernetes: allow kubelet to create unlabeled dirs (diff) | |
| download | hardened-refpolicy-d15a97c13a82e5a4ba930f2fd5e823bbef3ce0da.tar.gz hardened-refpolicy-d15a97c13a82e5a4ba930f2fd5e823bbef3ce0da.tar.bz2 hardened-refpolicy-d15a97c13a82e5a4ba930f2fd5e823bbef3ce0da.zip | |
container: allow super privileged containers to manage BPF dirs
Seen on a recent update to Cilium.
Signed-off-by: Kenton Groombridge <concord@gentoo.org>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
| -rw-r--r-- | policy/modules/kernel/filesystem.if | 18 | ||||
| -rw-r--r-- | policy/modules/services/container.te | 2 |
2 files changed, 19 insertions, 1 deletions
diff --git a/policy/modules/kernel/filesystem.if b/policy/modules/kernel/filesystem.if index ae022b6c0..6fae5d991 100644 --- a/policy/modules/kernel/filesystem.if +++ b/policy/modules/kernel/filesystem.if @@ -734,6 +734,24 @@ interface(`fs_create_bpf_dirs',` ######################################## ## <summary> +## Manage bpf directories. +## </summary> +## <param name="domain"> +## <summary> +## Domain allowed access. +## </summary> +## </param> +# +interface(`fs_manage_bpf_dirs',` + gen_require(` + type bpf_t; + ') + + manage_dirs_pattern($1, bpf_t, bpf_t) +') + +######################################## +## <summary> ## Manage bpf files. ## </summary> ## <param name="domain"> diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 864fae707..66b16e4e4 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -1041,7 +1041,7 @@ fs_mounton_cgroup(spc_t) fs_manage_cgroup_dirs(spc_t) fs_manage_cgroup_files(spc_t) fs_mount_bpf(spc_t) -fs_create_bpf_dirs(spc_t) +fs_manage_bpf_dirs(spc_t) fs_manage_bpf_files(spc_t) fs_manage_bpf_symlinks(spc_t) fs_mounton_fusefs(spc_t) |