diff --git a/config/Makefile.am b/config/Makefile.am index e40f84237..37fd24ba2 100644 --- a/config/Makefile.am +++ b/config/Makefile.am @@ -1 +1 @@ -SUBDIRS = apparmor bash etc init templates yum +SUBDIRS = apparmor bash etc init selinux templates yum diff --git a/config/selinux/Makefile.am b/config/selinux/Makefile.am new file mode 100644 index 000000000..9a2b21ce6 --- /dev/null +++ b/config/selinux/Makefile.am @@ -0,0 +1,8 @@ +selinuxdir=@DATADIR@/lxc/selinux + +EXTRA_DIST = \ + lxc.if lxc.te + +selinux_DATA = \ + lxc.if \ + lxc.te diff --git a/config/selinux/lxc.if b/config/selinux/lxc.if new file mode 100644 index 000000000..3f8f99553 --- /dev/null +++ b/config/selinux/lxc.if @@ -0,0 +1 @@ +## Policy for LXC containers diff --git a/config/selinux/lxc.te b/config/selinux/lxc.te new file mode 100644 index 000000000..4ecb9db78 --- /dev/null +++ b/config/selinux/lxc.te @@ -0,0 +1,88 @@ +# +# SELinux policy for LXC for RHEL/CentOS/Oracle 6.5. +# It attempts to restrict the container to the same amount of access +# as an unprivileged user. To build and insert this policy module: +# +# make -f /usr/share/selinux/devel/Makefile lxc.pp +# semodule -i lxc.pp +# +# In your container's lxc config: +# lxc.se_context = system_u:system_r:lxc_t:s0:c62,c86,c150,c228 +# +# Ensure your container's rootfs files are labeled: +# chcon -R system_u:object_r:lxc_file_t:s0:c62,c86,c150,c228 /path/to/rootfs +# +# To keep containers separated from each other, you should vary the MCS +# portion of the contexts above to be a unique set of values for each +# container, each MCS compartment can be a number from 0-1023. +# + +policy_module(lxc,0.35) + +userdom_unpriv_user_template(lxc) + +type lxc_file_t; +files_type(lxc_file_t); +role system_r types { lxc_t lxc_file_t }; + +gen_require(` + type devpts_t; + type proc_t; + type ssh_port_t; + type sysctl_kernel_t; + type sysctl_modprobe_t; + type sysctl_net_t; + type tmpfs_t; + type unconfined_t; + class filesystem { relabelfrom unmount }; + class tcp_socket name_bind; + class udp_socket name_bind; +'); + +# So lxc can transition to lxc_t on exec +allow unconfined_t lxc_t:process transition; +can_exec(lxc_t, lxc_file_t) + +# So lxc can dyntransition to lxc_t for attach executing a function +allow unconfined_t lxc_t:process dyntransition; + +# So lxc-start can relabel the pty allocated for the console +allow lxc_file_t devpts_t:filesystem associate; + +# So container can mount /dev/shm and relabel it +allow lxc_t tmpfs_t:filesystem relabelfrom; + +# Allow all access to an lxc_file_t type; devices can be restricted +# with the device cgroup, they are not here +allow lxc_t lxc_file_t:file *; +allow lxc_t lxc_file_t:lnk_file *; +allow lxc_t lxc_file_t:chr_file *; +allow lxc_t lxc_file_t:blk_file *; +allow lxc_t lxc_file_t:sock_file *; +allow lxc_t lxc_file_t:fifo_file *; +allow lxc_t lxc_file_t:socket *; +allow lxc_t lxc_file_t:dir *; +allow lxc_t lxc_file_t:filesystem unmount; + +fs_unmount_all_fs(lxc_t) + +allow lxc_t proc_t:dir mounton; +allow lxc_t proc_t:filesystem mount; + +allow lxc_t tmpfs_t:filesystem mount; +allow lxc_t self:capability { dac_override dac_read_search fsetid ipc_lock net_admin net_bind_service net_broadcast net_raw sys_admin sys_boot sys_tty_config }; + +allow lxc_t sysctl_net_t:file write; +allow lxc_t ssh_port_t:tcp_socket name_bind; + +corenet_tcp_connect_all_ports(lxc_t) +corenet_tcp_bind_all_ports(lxc_t) +corenet_udp_bind_all_ports(lxc_t) + +# Needed for ifup/ip/dhcp +allow lxc_t self:packet_socket create_socket_perms; +allow lxc_t self:rawip_socket create_socket_perms; +allow lxc_t self:netlink_route_socket create_netlink_socket_perms; + +dontaudit lxc_t sysctl_kernel_t:file write; +dontaudit lxc_t sysctl_modprobe_t:file write; diff --git a/configure.ac b/configure.ac index 23a5b012f..4f39054e1 100644 --- a/configure.ac +++ b/configure.ac @@ -594,6 +594,7 @@ AC_CONFIG_FILES([ config/Makefile config/apparmor/Makefile + config/selinux/Makefile config/bash/Makefile config/bash/lxc config/init/Makefile diff --git a/doc/lxc.container.conf.sgml.in b/doc/lxc.container.conf.sgml.in index d0c18fe46..a4485bc4a 100644 --- a/doc/lxc.container.conf.sgml.in +++ b/doc/lxc.container.conf.sgml.in @@ -1055,6 +1055,8 @@ proc proc proc nodev,noexec,nosuid 0 0 container should be run can be specified in the container configuration. The default is unconfined_t, which means that lxc will not attempt to change contexts. + See @DATADIR@/lxc/selinux/lxc.te for an example policy and more + information. @@ -1066,7 +1068,7 @@ proc proc proc nodev,noexec,nosuid 0 0 Specify the SELinux context under which the container should be run or unconfined_t. For example - lxc.se_context = unconfined_u:unconfined_r:lxc_t:s0-s0:c0.c1023 + lxc.se_context = system_u:system_r:lxc_t:s0:c22