diff options
| author |   Nicolas Iooss <nicolas.iooss@m4x.org> | 2019-12-22 18:17:36 +0100 |
|---|---|---|
| committer |   Jason Zaman <perfinion@gentoo.org> | 2020-02-15 15:22:28 +0800 |
| commit | 256bc04e6ffac4bafeb6e91cb85c18739ead2e89 (patch) | |
| tree | 7f74402f4a34526c0406e88533da16da01937375 | |
| parent | Vagrantfile: remove sudo (diff) | |
| download | hardened-refpolicy-256bc04e6ffac4bafeb6e91cb85c18739ead2e89.tar.gz hardened-refpolicy-256bc04e6ffac4bafeb6e91cb85c18739ead2e89.tar.bz2 hardened-refpolicy-256bc04e6ffac4bafeb6e91cb85c18739ead2e89.zip | |
Vagrantfile: add a specific SELinux policy module
When using Vagrant to run virtual machines with SELinux enabled, several
specific accesses need to be allowed. It does not make much sense to add
the needed rules to the refpolicy, as they are very specific to the use
of Vagrant to provision a virtual machine to test a policy. Therefore,
create a dedicated module to allow the required accesses.
Signed-off-by: Nicolas Iooss <nicolas.iooss@m4x.org>
Signed-off-by: Jason Zaman <perfinion@gentoo.org>
| -rw-r--r-- | Vagrantfile | 3 | ||||
| -rw-r--r-- | support/vagrant-vm.cil | 21 |
2 files changed, 24 insertions, 0 deletions
diff --git a/Vagrantfile b/Vagrantfile index 2b7d9948a..2dd0f8ce2 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -19,6 +19,9 @@ $install_refpolicy = <<-SHELL make -C /vagrant install-headers semodule -s refpolicy -i /usr/share/selinux/refpolicy/*.pp + # Load the module specific to Vagrant VM + semodule -s refpolicy -i /vagrant/support/vagrant-vm.cil + if ! (LANG=C sestatus -v | grep '^Loaded policy name:\s*refpolicy$' > /dev/null) then # Use the reference policy diff --git a/support/vagrant-vm.cil b/support/vagrant-vm.cil new file mode 100644 index 000000000..b969ffda1 --- /dev/null +++ b/support/vagrant-vm.cil @@ -0,0 +1,21 @@ +; SELinux policy module for running virtual machines with Vagrant + +; Vagrant performs "ssh sudo ..." without allocating a pseudo-terminal. +; This leads sudo to directly using sshd pipes, as well as other processes +; spawned from the provision scripts. Define an attribute for those processes. +(typeattribute vagrant_provisioning_cmd_type) +(typeattributeset vagrant_provisioning_cmd_type ( + load_policy_t + semanage_t + setfiles_t + sudodomain +)) +(allow vagrant_provisioning_cmd_type sshd_t (fifo_file (append getattr ioctl read write))) + +; "vagrant rsync" makes Vagrant invoke "sudo rsync" without a shell which would +; make sudo transition out of sysadm_sudo_t. +; Therefore add a transition from sysadm_sudo_t to sysadm_t through rsync_exec_t +(optional sysadm_sudo_rsync_transition + (allow sysadm_t rsync_exec_t (file (entrypoint))) + (typetransition sysadm_sudo_t rsync_exec_t process sysadm_t) +) |