Multiple adjustments to the virt-launcher SELinux policy
Make virt_launcher.process mcs-constrained
Reduce the allow rules to a minimum
Add a rule to allow the use of hugepages
(block virt_launcher
(blockinherit container)
(typeattributeset sandbox_net_domain (process))
- (allow process kernel_t (system (module_request)))
- (allow process mtrr_device_t (file (write)))
- (allow process self (tun_socket (relabelfrom)))
- (allow process self (tun_socket (relabelto)))
- (allow process self (tun_socket (attach_queue)))
- (allow process sysfs_t (file (write)))
- (allow process tmp_t (dir (write add_name open getattr setattr read link search remove_name reparent lock ioctl)))
- (allow process tmp_t (file (setattr open read write create getattr append ioctl lock)))
- (allow process container_share_t (dir (write add_name)))
- (allow process container_share_t (file (create setattr write )))
- (allow process container_var_run_t (dir (write add_name open getattr setattr read link search remove_name reparent lock ioctl)))
- (allow process container_var_run_t (file (setattr open read write create getattr append ioctl lock))))
+ (typeattributeset mcs_constrained_type (process))
+ (allow process self (tun_socket (relabelfrom relabelto attach_queue)))
+ (allow process hugetlbfs_t (dir (add_name create write remove_name rmdir setattr)))
+ (allow process hugetlbfs_t (file (create unlink))))
