4 deleted 2 characters in body
source | link

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example container_execheap:

    policy_module(container_execheap, 1.0)
    
    virt_sandbox_domain_template(container_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (necessary development files, including the makefile, should be provided by selinux-policy-devel package):

    make -f /usr/selinux/devel/Makefile container_execheap.pp
    semodule -i container_execheap.pp
    

    The new type can be configured to be a permissive domain:

    semanage permissive -a container_execheap_t`.container_execheap_t
    

    For permissive domains, AVC denials are logged but rules are not enforced. This way it is easy to generate the missing rules later using audit2allow.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:container_execheap_t ...

  4. Generate expected errors. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (remember to bump up version number) with the new rules. Compile and install the updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d container_execheap.

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example container_execheap:

    policy_module(container_execheap, 1.0)
    
    virt_sandbox_domain_template(container_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (necessary development files, including the makefile, should be provided by selinux-policy-devel package):

    make -f /usr/selinux/devel/Makefile container_execheap.pp
    semodule -i container_execheap.pp
    

    The new type can be configured to be a permissive domain:

    semanage permissive -a container_execheap_t`.
    

    For permissive domains, AVC denials are logged but rules are not enforced. This way it is easy to generate the missing rules later using audit2allow.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:container_execheap_t ...

  4. Generate expected errors. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (remember to bump up version number) with the new rules. Compile and install the updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d container_execheap.

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example container_execheap:

    policy_module(container_execheap, 1.0)
    
    virt_sandbox_domain_template(container_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (necessary development files, including the makefile, should be provided by selinux-policy-devel package):

    make -f /usr/selinux/devel/Makefile container_execheap.pp
    semodule -i container_execheap.pp
    

    The new type can be configured to be a permissive domain:

    semanage permissive -a container_execheap_t
    

    For permissive domains, AVC denials are logged but rules are not enforced. This way it is easy to generate the missing rules later using audit2allow.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:container_execheap_t ...

  4. Generate expected errors. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (remember to bump up version number) with the new rules. Compile and install the updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d container_execheap.

3 style + clarification
source | link

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example container_execheap:

    policy_module(container_execheap, 1.0)
    
    virt_sandbox_domain_template(container_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (seenecessary development files, including the blog post for details) and set it into permissive modemakefile, should be provided by semanage permissive selinux-a container_execheap_tpolicy-devel. In package):

    make -f /usr/selinux/devel/Makefile container_execheap.pp
    semodule -i container_execheap.pp
    

    The new type can be configured to be a permissive modedomain:

    semanage permissive -a container_execheap_t`.
    

    For permissive domains, AVC denials are logged but rules are not enforced. This way it is easy to generate the missing rules later using audit2allow.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:container_execheap_t ...

  4. Generate expected errors. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (remember to bump up version number) with the new rules. Compile and install the updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d container_execheap.

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example container_execheap:

    policy_module(container_execheap, 1.0)
    
    virt_sandbox_domain_template(container_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (see the blog post for details) and set it into permissive mode by semanage permissive -a container_execheap_t. In permissive mode AVC denials are logged but rules are not enforced.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:container_execheap_t ...

  4. Generate expected errors. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (remember to bump up version number) with the new rules. Compile and install the updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d container_execheap.

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example container_execheap:

    policy_module(container_execheap, 1.0)
    
    virt_sandbox_domain_template(container_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (necessary development files, including the makefile, should be provided by selinux-policy-devel package):

    make -f /usr/selinux/devel/Makefile container_execheap.pp
    semodule -i container_execheap.pp
    

    The new type can be configured to be a permissive domain:

    semanage permissive -a container_execheap_t`.
    

    For permissive domains, AVC denials are logged but rules are not enforced. This way it is easy to generate the missing rules later using audit2allow.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:container_execheap_t ...

  4. Generate expected errors. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (remember to bump up version number) with the new rules. Compile and install the updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d container_execheap.

2 style + clarification
source | link

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example execheap_container_tcontainer_execheap:

    policy_module(execheap_container_tcontainer_execheap, 1.0)
    
    virt_sandbox_domain_template(container_loggercontainer_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (see the blog post for details) and set it into permissive mode by semanage permissive -a execheap_container_tcontainer_execheap_t. In permissive mode AVC denials are logged but rules are notnot enforced.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:execheap_container_tcontainer_execheap_t ...

  4. Generate expected errors and. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (bumpremember to bump up version number) and compilewith the new rules. Compile and install itthe updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d execheap_container_tcontainer_execheap.

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules.

  1. Create a basic container policy, for example execheap_container_t:

    policy_module(execheap_container_t, 1.0)
    
    virt_sandbox_domain_template(container_logger)
    
  2. Compile and load the policy module (see the blog post for details) and set it into permissive mode by semanage permissive -a execheap_container_t. In permissive mode AVC denials are logged but rules are not enforced.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:execheap_container_t ...

  4. Generate expected errors and run audit2allow. You can update the same module .te file (bump up version number) and compile and install it.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d execheap_container_t.

audit2allow likely generates a rule to allow execheap for container_t type process. You can always first generate the module and inspect it, before you load it.

A possible problem is, that now any process with container_t type is now allowed the same operation. To avoid this, you possibly need to create your own custom type (using container_t as template) and only allow execheap for this special type.

This blog post by Dan Walsh explains how to write such custom policy. You can also combine this with audit2allow to generate the actual rules. The essential steps are:

  1. Create a basic container policy, for example container_execheap:

    policy_module(container_execheap, 1.0)
    
    virt_sandbox_domain_template(container_execheap_t)
    

    virt_sandbox_domain_template macro creates the new type container_execheap_t and creates necessary rules for docker operation that the new type can be used as container domain.

  2. Compile and load the policy module (see the blog post for details) and set it into permissive mode by semanage permissive -a container_execheap_t. In permissive mode AVC denials are logged but rules are not enforced.

  3. Run your container in this new context, something like docker run ... --security-opt label:type:container_execheap_t ...

  4. Generate expected errors. Then run audit2allow to generate rules allowing those operations for container_execheap_t. You can update the same module .te file (remember to bump up version number) with the new rules. Compile and install the updated module.

  5. When no more errors generated, put the custom container type back into enforcing mode semanage -d container_execheap.

    Bounty Ended with 100 reputation awarded by Jeff Schaller
1
source | link