Merge pull request #157 from miaoyq/apply-selinux-opt
Support selinux options/label
This commit is contained in:
Lantao Liu
GitHub
commit
9c49624174
@ -20,6 +20,7 @@ import (
|
|||||||
"os"
|
"os"
|
||||||
|
|
||||||
"github.com/golang/glog"
|
"github.com/golang/glog"
|
||||||
|
"github.com/opencontainers/selinux/go-selinux"
|
||||||
"github.com/spf13/pflag"
|
"github.com/spf13/pflag"
|
||||||
|
|
||||||
"github.com/kubernetes-incubator/cri-containerd/cmd/cri-containerd/options"
|
"github.com/kubernetes-incubator/cri-containerd/cmd/cri-containerd/options"
|
||||||
@ -37,6 +38,10 @@ func main() {
|
|||||||
os.Exit(0)
|
os.Exit(0)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if !o.EnableSelinux {
|
||||||
|
selinux.SetDisabled()
|
||||||
|
}
|
||||||
|
|
||||||
glog.V(2).Infof("Run cri-containerd grpc server on socket %q", o.SocketPath)
|
glog.V(2).Infof("Run cri-containerd grpc server on socket %q", o.SocketPath)
|
||||||
service, err := server.NewCRIContainerdService(
|
service, err := server.NewCRIContainerdService(
|
||||||
o.ContainerdEndpoint,
|
o.ContainerdEndpoint,
|
||||||
|
|||||||
@ -46,6 +46,8 @@ type CRIContainerdOptions struct {
|
|||||||
StreamServerPort string
|
StreamServerPort string
|
||||||
// CgroupPath is the path for the cgroup that cri-containerd is placed in.
|
// CgroupPath is the path for the cgroup that cri-containerd is placed in.
|
||||||
CgroupPath string
|
CgroupPath string
|
||||||
|
// EnableSelinux indicates to enable the selinux support
|
||||||
|
EnableSelinux bool
|
||||||
}
|
}
|
||||||
|
|
||||||
// NewCRIContainerdOptions returns a reference to CRIContainerdOptions
|
// NewCRIContainerdOptions returns a reference to CRIContainerdOptions
|
||||||
@ -74,6 +76,8 @@ func (c *CRIContainerdOptions) AddFlags(fs *pflag.FlagSet) {
|
|||||||
fs.StringVar(&c.StreamServerPort, "stream-port",
|
fs.StringVar(&c.StreamServerPort, "stream-port",
|
||||||
"10010", "The port streaming server is listening on.")
|
"10010", "The port streaming server is listening on.")
|
||||||
fs.StringVar(&c.CgroupPath, "cgroup-path", "", "The cgroup that cri-containerd is part of. By default cri-containerd is not placed in a cgroup")
|
fs.StringVar(&c.CgroupPath, "cgroup-path", "", "The cgroup that cri-containerd is part of. By default cri-containerd is not placed in a cgroup")
|
||||||
|
fs.BoolVar(&c.EnableSelinux, "selinux-enabled",
|
||||||
|
false, "Enable selinux support.")
|
||||||
}
|
}
|
||||||
|
|
||||||
// InitFlags must be called after adding all cli options flags are defined and
|
// InitFlags must be called after adding all cli options flags are defined and
|
||||||
|
|||||||
@ -27,7 +27,9 @@ import (
|
|||||||
"github.com/opencontainers/runc/libcontainer/devices"
|
"github.com/opencontainers/runc/libcontainer/devices"
|
||||||
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
|
runtimespec "github.com/opencontainers/runtime-spec/specs-go"
|
||||||
"github.com/opencontainers/runtime-tools/generate"
|
"github.com/opencontainers/runtime-tools/generate"
|
||||||
|
"github.com/opencontainers/selinux/go-selinux/label"
|
||||||
"golang.org/x/net/context"
|
"golang.org/x/net/context"
|
||||||
|
"golang.org/x/sys/unix"
|
||||||
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
|
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
|
||||||
|
|
||||||
cio "github.com/kubernetes-incubator/cri-containerd/pkg/server/io"
|
cio "github.com/kubernetes-incubator/cri-containerd/pkg/server/io"
|
||||||
@ -234,9 +236,17 @@ func (c *criContainerdService) generateContainerSpec(id string, sandboxPid uint3
|
|||||||
}
|
}
|
||||||
|
|
||||||
securityContext := config.GetLinux().GetSecurityContext()
|
securityContext := config.GetLinux().GetSecurityContext()
|
||||||
|
selinuxOpt := securityContext.GetSelinuxOptions()
|
||||||
|
processLabel, mountLabel, err := initSelinuxOpts(selinuxOpt)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to init selinux options %+v: %v", securityContext.GetSelinuxOptions(), err)
|
||||||
|
}
|
||||||
|
|
||||||
// Add extra mounts first so that CRI specified mounts can override.
|
// Add extra mounts first so that CRI specified mounts can override.
|
||||||
addOCIBindMounts(&g, append(extraMounts, config.GetMounts()...))
|
mounts := append(extraMounts, config.GetMounts()...)
|
||||||
|
if err := addOCIBindMounts(&g, mounts, mountLabel); err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to set OCI bind mounts %+v: %v", mounts, err)
|
||||||
|
}
|
||||||
|
|
||||||
if securityContext.GetPrivileged() {
|
if securityContext.GetPrivileged() {
|
||||||
if !sandboxConfig.GetLinux().GetSecurityContext().GetPrivileged() {
|
if !sandboxConfig.GetLinux().GetSecurityContext().GetPrivileged() {
|
||||||
@ -259,6 +269,9 @@ func (c *criContainerdService) generateContainerSpec(id string, sandboxPid uint3
|
|||||||
|
|
||||||
}
|
}
|
||||||
|
|
||||||
|
g.SetProcessSelinuxLabel(processLabel)
|
||||||
|
g.SetLinuxMountLabel(mountLabel)
|
||||||
|
|
||||||
// TODO: Figure out whether we should set no new privilege for sandbox container by default
|
// TODO: Figure out whether we should set no new privilege for sandbox container by default
|
||||||
g.SetProcessNoNewPrivileges(securityContext.GetNoNewPrivs())
|
g.SetProcessNoNewPrivileges(securityContext.GetNoNewPrivs())
|
||||||
|
|
||||||
@ -435,7 +448,7 @@ func setOCIDevicesPrivileged(g *generate.Generator) error {
|
|||||||
// addOCIBindMounts adds bind mounts.
|
// addOCIBindMounts adds bind mounts.
|
||||||
// TODO(random-liu): Figure out whether we need to change all CRI mounts to readonly when
|
// TODO(random-liu): Figure out whether we need to change all CRI mounts to readonly when
|
||||||
// rootfs is readonly. (https://github.com/moby/moby/blob/master/daemon/oci_linux.go)
|
// rootfs is readonly. (https://github.com/moby/moby/blob/master/daemon/oci_linux.go)
|
||||||
func addOCIBindMounts(g *generate.Generator, mounts []*runtime.Mount) {
|
func addOCIBindMounts(g *generate.Generator, mounts []*runtime.Mount, mountLabel string) error {
|
||||||
// Mount cgroup into the container as readonly, which inherits docker's behavior.
|
// Mount cgroup into the container as readonly, which inherits docker's behavior.
|
||||||
g.AddCgroupsMount("ro") // nolint: errcheck
|
g.AddCgroupsMount("ro") // nolint: errcheck
|
||||||
for _, mount := range mounts {
|
for _, mount := range mounts {
|
||||||
@ -447,9 +460,16 @@ func addOCIBindMounts(g *generate.Generator, mounts []*runtime.Mount) {
|
|||||||
} else {
|
} else {
|
||||||
options = append(options, "rw")
|
options = append(options, "rw")
|
||||||
}
|
}
|
||||||
// TODO(random-liu): [P1] Apply selinux label
|
|
||||||
|
if mount.GetSelinuxRelabel() {
|
||||||
|
if err := label.Relabel(src, mountLabel, true); err != nil && err != unix.ENOTSUP {
|
||||||
|
return fmt.Errorf("relabel %q with %q failed: %v", src, mountLabel, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
g.AddBindMount(src, dst, options)
|
g.AddBindMount(src, dst, options)
|
||||||
}
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
}
|
}
|
||||||
|
|
||||||
func setOCIBindMountsPrivileged(g *generate.Generator) {
|
func setOCIBindMountsPrivileged(g *generate.Generator) {
|
||||||
|
|||||||
@ -419,7 +419,7 @@ func TestPrivilegedBindMount(t *testing.T) {
|
|||||||
t.Logf("TestCase %q", desc)
|
t.Logf("TestCase %q", desc)
|
||||||
g := generate.New()
|
g := generate.New()
|
||||||
g.SetRootReadonly(test.readonlyRootFS)
|
g.SetRootReadonly(test.readonlyRootFS)
|
||||||
addOCIBindMounts(&g, nil)
|
addOCIBindMounts(&g, nil, "")
|
||||||
if test.privileged {
|
if test.privileged {
|
||||||
setOCIBindMountsPrivileged(&g)
|
setOCIBindMountsPrivileged(&g)
|
||||||
}
|
}
|
||||||
|
|||||||
@ -33,6 +33,8 @@ import (
|
|||||||
"github.com/opencontainers/image-spec/identity"
|
"github.com/opencontainers/image-spec/identity"
|
||||||
imagespec "github.com/opencontainers/image-spec/specs-go/v1"
|
imagespec "github.com/opencontainers/image-spec/specs-go/v1"
|
||||||
specs "github.com/opencontainers/runtime-spec/specs-go"
|
specs "github.com/opencontainers/runtime-spec/specs-go"
|
||||||
|
"github.com/opencontainers/selinux/go-selinux"
|
||||||
|
"github.com/opencontainers/selinux/go-selinux/label"
|
||||||
"golang.org/x/net/context"
|
"golang.org/x/net/context"
|
||||||
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
|
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
|
||||||
|
|
||||||
@ -374,3 +376,16 @@ func getImageInfo(ctx context.Context, image containerd.Image, provider content.
|
|||||||
config: ociimage.Config,
|
config: ociimage.Config,
|
||||||
}, nil
|
}, nil
|
||||||
}
|
}
|
||||||
|
|
||||||
|
func initSelinuxOpts(selinuxOpt *runtime.SELinuxOption) (string, string, error) {
|
||||||
|
if selinuxOpt == nil {
|
||||||
|
return "", "", nil
|
||||||
|
}
|
||||||
|
|
||||||
|
labelOpts := fmt.Sprintf("%s:%s:%s:%s",
|
||||||
|
selinuxOpt.GetUser(),
|
||||||
|
selinuxOpt.GetRole(),
|
||||||
|
selinuxOpt.GetRole(),
|
||||||
|
selinuxOpt.GetType())
|
||||||
|
return label.InitLabels(selinux.DupSecOpt(labelOpts))
|
||||||
|
}
|
||||||
|
|||||||
71
pkg/server/helpers_selinux_test.go
Normal file
71
pkg/server/helpers_selinux_test.go
Normal file
@ -0,0 +1,71 @@
|
|||||||
|
// +build selinux
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright 2017 The Kubernetes Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package server
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"github.com/opencontainers/selinux/go-selinux"
|
||||||
|
"github.com/stretchr/testify/assert"
|
||||||
|
"k8s.io/kubernetes/pkg/kubelet/apis/cri/v1alpha1/runtime"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestInitSelinuxOpts(t *testing.T) {
|
||||||
|
if !selinux.GetEnabled() {
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
for desc, test := range map[string]struct {
|
||||||
|
selinuxOpt *runtime.SELinuxOption
|
||||||
|
processLabel string
|
||||||
|
mountLabels []string
|
||||||
|
}{
|
||||||
|
"testNullValue": {
|
||||||
|
selinuxOpt: nil,
|
||||||
|
processLabel: "",
|
||||||
|
mountLabels: []string{"", ""},
|
||||||
|
},
|
||||||
|
"testEmptyString": {
|
||||||
|
selinuxOpt: &runtime.SELinuxOption{
|
||||||
|
User: "",
|
||||||
|
Role: "",
|
||||||
|
Type: "",
|
||||||
|
Level: "",
|
||||||
|
},
|
||||||
|
processLabel: ":::",
|
||||||
|
mountLabels: []string{":object_r:container_file_t:", ":object_r:svirt_sandbox_file_t:"},
|
||||||
|
},
|
||||||
|
"testUser": {
|
||||||
|
selinuxOpt: &runtime.SELinuxOption{
|
||||||
|
User: "user_u",
|
||||||
|
Role: "user_r",
|
||||||
|
Type: "user_t",
|
||||||
|
Level: "s0:c1,c2",
|
||||||
|
},
|
||||||
|
processLabel: "user_u:user_r:user_t:s0:c1,c2",
|
||||||
|
mountLabels: []string{"user_u:object_r:container_file_t:s0:c1,c2", "user_u:object_r:svirt_sandbox_file_t:s0:c1,c2"},
|
||||||
|
},
|
||||||
|
} {
|
||||||
|
t.Logf("TestCase %q", desc)
|
||||||
|
processLabel, mountLabel, err := initSelinuxOpts(test.selinuxOpt)
|
||||||
|
assert.NoError(t, err)
|
||||||
|
assert.Equal(t, test.processLabel, processLabel)
|
||||||
|
assert.Contains(t, test.mountLabels, mountLabel)
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -275,7 +275,13 @@ func (c *criContainerdService) generateSandboxContainerSpec(id string, config *r
|
|||||||
g.RemoveLinuxNamespace(string(runtimespec.IPCNamespace)) // nolint: errcheck
|
g.RemoveLinuxNamespace(string(runtimespec.IPCNamespace)) // nolint: errcheck
|
||||||
}
|
}
|
||||||
|
|
||||||
// TODO(random-liu): [P1] Apply SeLinux options.
|
selinuxOpt := securityContext.GetSelinuxOptions()
|
||||||
|
processLabel, mountLabel, err := initSelinuxOpts(selinuxOpt)
|
||||||
|
if err != nil {
|
||||||
|
return nil, fmt.Errorf("failed to init selinux options %+v: %v", securityContext.GetSelinuxOptions(), err)
|
||||||
|
}
|
||||||
|
g.SetProcessSelinuxLabel(processLabel)
|
||||||
|
g.SetLinuxMountLabel(mountLabel)
|
||||||
|
|
||||||
supplementalGroups := securityContext.GetSupplementalGroups()
|
supplementalGroups := securityContext.GetSupplementalGroups()
|
||||||
for _, group := range supplementalGroups {
|
for _, group := range supplementalGroups {
|
||||||
|
|||||||
@ -35,6 +35,7 @@ github.com/opencontainers/image-spec v1.0.0
|
|||||||
github.com/opencontainers/runc e775f0fba3ea329b8b766451c892c41a3d49594d
|
github.com/opencontainers/runc e775f0fba3ea329b8b766451c892c41a3d49594d
|
||||||
github.com/opencontainers/runtime-spec v1.0.0
|
github.com/opencontainers/runtime-spec v1.0.0
|
||||||
github.com/opencontainers/runtime-tools e29f3ca4eb806a582ee1a1864c7b0563bd64c19b
|
github.com/opencontainers/runtime-tools e29f3ca4eb806a582ee1a1864c7b0563bd64c19b
|
||||||
|
github.com/opencontainers/selinux 4a2974bf1ee960774ffd517717f1f45325af0206
|
||||||
github.com/pkg/errors v0.8.0
|
github.com/pkg/errors v0.8.0
|
||||||
github.com/pmezard/go-difflib v1.0.0
|
github.com/pmezard/go-difflib v1.0.0
|
||||||
github.com/PuerkitoBio/purell v1.0.0
|
github.com/PuerkitoBio/purell v1.0.0
|
||||||
|
|||||||
201
vendor/github.com/opencontainers/selinux/LICENSE
generated
vendored
Normal file
201
vendor/github.com/opencontainers/selinux/LICENSE
generated
vendored
Normal file
@ -0,0 +1,201 @@
|
|||||||
|
Apache License
|
||||||
|
Version 2.0, January 2004
|
||||||
|
http://www.apache.org/licenses/
|
||||||
|
|
||||||
|
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||||
|
|
||||||
|
1. Definitions.
|
||||||
|
|
||||||
|
"License" shall mean the terms and conditions for use, reproduction,
|
||||||
|
and distribution as defined by Sections 1 through 9 of this document.
|
||||||
|
|
||||||
|
"Licensor" shall mean the copyright owner or entity authorized by
|
||||||
|
the copyright owner that is granting the License.
|
||||||
|
|
||||||
|
"Legal Entity" shall mean the union of the acting entity and all
|
||||||
|
other entities that control, are controlled by, or are under common
|
||||||
|
control with that entity. For the purposes of this definition,
|
||||||
|
"control" means (i) the power, direct or indirect, to cause the
|
||||||
|
direction or management of such entity, whether by contract or
|
||||||
|
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||||
|
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||||
|
|
||||||
|
"You" (or "Your") shall mean an individual or Legal Entity
|
||||||
|
exercising permissions granted by this License.
|
||||||
|
|
||||||
|
"Source" form shall mean the preferred form for making modifications,
|
||||||
|
including but not limited to software source code, documentation
|
||||||
|
source, and configuration files.
|
||||||
|
|
||||||
|
"Object" form shall mean any form resulting from mechanical
|
||||||
|
transformation or translation of a Source form, including but
|
||||||
|
not limited to compiled object code, generated documentation,
|
||||||
|
and conversions to other media types.
|
||||||
|
|
||||||
|
"Work" shall mean the work of authorship, whether in Source or
|
||||||
|
Object form, made available under the License, as indicated by a
|
||||||
|
copyright notice that is included in or attached to the work
|
||||||
|
(an example is provided in the Appendix below).
|
||||||
|
|
||||||
|
"Derivative Works" shall mean any work, whether in Source or Object
|
||||||
|
form, that is based on (or derived from) the Work and for which the
|
||||||
|
editorial revisions, annotations, elaborations, or other modifications
|
||||||
|
represent, as a whole, an original work of authorship. For the purposes
|
||||||
|
of this License, Derivative Works shall not include works that remain
|
||||||
|
separable from, or merely link (or bind by name) to the interfaces of,
|
||||||
|
the Work and Derivative Works thereof.
|
||||||
|
|
||||||
|
"Contribution" shall mean any work of authorship, including
|
||||||
|
the original version of the Work and any modifications or additions
|
||||||
|
to that Work or Derivative Works thereof, that is intentionally
|
||||||
|
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||||
|
or by an individual or Legal Entity authorized to submit on behalf of
|
||||||
|
the copyright owner. For the purposes of this definition, "submitted"
|
||||||
|
means any form of electronic, verbal, or written communication sent
|
||||||
|
to the Licensor or its representatives, including but not limited to
|
||||||
|
communication on electronic mailing lists, source code control systems,
|
||||||
|
and issue tracking systems that are managed by, or on behalf of, the
|
||||||
|
Licensor for the purpose of discussing and improving the Work, but
|
||||||
|
excluding communication that is conspicuously marked or otherwise
|
||||||
|
designated in writing by the copyright owner as "Not a Contribution."
|
||||||
|
|
||||||
|
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||||
|
on behalf of whom a Contribution has been received by Licensor and
|
||||||
|
subsequently incorporated within the Work.
|
||||||
|
|
||||||
|
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
copyright license to reproduce, prepare Derivative Works of,
|
||||||
|
publicly display, publicly perform, sublicense, and distribute the
|
||||||
|
Work and such Derivative Works in Source or Object form.
|
||||||
|
|
||||||
|
3. Grant of Patent License. Subject to the terms and conditions of
|
||||||
|
this License, each Contributor hereby grants to You a perpetual,
|
||||||
|
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||||
|
(except as stated in this section) patent license to make, have made,
|
||||||
|
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||||
|
where such license applies only to those patent claims licensable
|
||||||
|
by such Contributor that are necessarily infringed by their
|
||||||
|
Contribution(s) alone or by combination of their Contribution(s)
|
||||||
|
with the Work to which such Contribution(s) was submitted. If You
|
||||||
|
institute patent litigation against any entity (including a
|
||||||
|
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||||
|
or a Contribution incorporated within the Work constitutes direct
|
||||||
|
or contributory patent infringement, then any patent licenses
|
||||||
|
granted to You under this License for that Work shall terminate
|
||||||
|
as of the date such litigation is filed.
|
||||||
|
|
||||||
|
4. Redistribution. You may reproduce and distribute copies of the
|
||||||
|
Work or Derivative Works thereof in any medium, with or without
|
||||||
|
modifications, and in Source or Object form, provided that You
|
||||||
|
meet the following conditions:
|
||||||
|
|
||||||
|
(a) You must give any other recipients of the Work or
|
||||||
|
Derivative Works a copy of this License; and
|
||||||
|
|
||||||
|
(b) You must cause any modified files to carry prominent notices
|
||||||
|
stating that You changed the files; and
|
||||||
|
|
||||||
|
(c) You must retain, in the Source form of any Derivative Works
|
||||||
|
that You distribute, all copyright, patent, trademark, and
|
||||||
|
attribution notices from the Source form of the Work,
|
||||||
|
excluding those notices that do not pertain to any part of
|
||||||
|
the Derivative Works; and
|
||||||
|
|
||||||
|
(d) If the Work includes a "NOTICE" text file as part of its
|
||||||
|
distribution, then any Derivative Works that You distribute must
|
||||||
|
include a readable copy of the attribution notices contained
|
||||||
|
within such NOTICE file, excluding those notices that do not
|
||||||
|
pertain to any part of the Derivative Works, in at least one
|
||||||
|
of the following places: within a NOTICE text file distributed
|
||||||
|
as part of the Derivative Works; within the Source form or
|
||||||
|
documentation, if provided along with the Derivative Works; or,
|
||||||
|
within a display generated by the Derivative Works, if and
|
||||||
|
wherever such third-party notices normally appear. The contents
|
||||||
|
of the NOTICE file are for informational purposes only and
|
||||||
|
do not modify the License. You may add Your own attribution
|
||||||
|
notices within Derivative Works that You distribute, alongside
|
||||||
|
or as an addendum to the NOTICE text from the Work, provided
|
||||||
|
that such additional attribution notices cannot be construed
|
||||||
|
as modifying the License.
|
||||||
|
|
||||||
|
You may add Your own copyright statement to Your modifications and
|
||||||
|
may provide additional or different license terms and conditions
|
||||||
|
for use, reproduction, or distribution of Your modifications, or
|
||||||
|
for any such Derivative Works as a whole, provided Your use,
|
||||||
|
reproduction, and distribution of the Work otherwise complies with
|
||||||
|
the conditions stated in this License.
|
||||||
|
|
||||||
|
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||||
|
any Contribution intentionally submitted for inclusion in the Work
|
||||||
|
by You to the Licensor shall be under the terms and conditions of
|
||||||
|
this License, without any additional terms or conditions.
|
||||||
|
Notwithstanding the above, nothing herein shall supersede or modify
|
||||||
|
the terms of any separate license agreement you may have executed
|
||||||
|
with Licensor regarding such Contributions.
|
||||||
|
|
||||||
|
6. Trademarks. This License does not grant permission to use the trade
|
||||||
|
names, trademarks, service marks, or product names of the Licensor,
|
||||||
|
except as required for reasonable and customary use in describing the
|
||||||
|
origin of the Work and reproducing the content of the NOTICE file.
|
||||||
|
|
||||||
|
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||||
|
agreed to in writing, Licensor provides the Work (and each
|
||||||
|
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||||
|
implied, including, without limitation, any warranties or conditions
|
||||||
|
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||||
|
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||||
|
appropriateness of using or redistributing the Work and assume any
|
||||||
|
risks associated with Your exercise of permissions under this License.
|
||||||
|
|
||||||
|
8. Limitation of Liability. In no event and under no legal theory,
|
||||||
|
whether in tort (including negligence), contract, or otherwise,
|
||||||
|
unless required by applicable law (such as deliberate and grossly
|
||||||
|
negligent acts) or agreed to in writing, shall any Contributor be
|
||||||
|
liable to You for damages, including any direct, indirect, special,
|
||||||
|
incidental, or consequential damages of any character arising as a
|
||||||
|
result of this License or out of the use or inability to use the
|
||||||
|
Work (including but not limited to damages for loss of goodwill,
|
||||||
|
work stoppage, computer failure or malfunction, or any and all
|
||||||
|
other commercial damages or losses), even if such Contributor
|
||||||
|
has been advised of the possibility of such damages.
|
||||||
|
|
||||||
|
9. Accepting Warranty or Additional Liability. While redistributing
|
||||||
|
the Work or Derivative Works thereof, You may choose to offer,
|
||||||
|
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||||
|
or other liability obligations and/or rights consistent with this
|
||||||
|
License. However, in accepting such obligations, You may act only
|
||||||
|
on Your own behalf and on Your sole responsibility, not on behalf
|
||||||
|
of any other Contributor, and only if You agree to indemnify,
|
||||||
|
defend, and hold each Contributor harmless for any liability
|
||||||
|
incurred by, or claims asserted against, such Contributor by reason
|
||||||
|
of your accepting any such warranty or additional liability.
|
||||||
|
|
||||||
|
END OF TERMS AND CONDITIONS
|
||||||
|
|
||||||
|
APPENDIX: How to apply the Apache License to your work.
|
||||||
|
|
||||||
|
To apply the Apache License to your work, attach the following
|
||||||
|
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||||
|
replaced with your own identifying information. (Don't include
|
||||||
|
the brackets!) The text should be enclosed in the appropriate
|
||||||
|
comment syntax for the file format. We also recommend that a
|
||||||
|
file or class name and description of purpose be included on the
|
||||||
|
same "printed page" as the copyright notice for easier
|
||||||
|
identification within third-party archives.
|
||||||
|
|
||||||
|
Copyright {yyyy} {name of copyright owner}
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
7
vendor/github.com/opencontainers/selinux/README.md
generated
vendored
Normal file
7
vendor/github.com/opencontainers/selinux/README.md
generated
vendored
Normal file
@ -0,0 +1,7 @@
|
|||||||
|
# selinux
|
||||||
|
|
||||||
|
[](https://godoc.org/github.com/opencontainers/selinux) [](https://goreportcard.com/report/github.com/opencontainers/selinux) [](https://travis-ci.org/opencontainers/selinux)
|
||||||
|
|
||||||
|
Common SELinux package used across the container ecosystem.
|
||||||
|
|
||||||
|
Please see the [godoc](https://godoc.org/github.com/opencontainers/selinux) for more information.
|
||||||
84
vendor/github.com/opencontainers/selinux/go-selinux/label/label.go
generated
vendored
Normal file
84
vendor/github.com/opencontainers/selinux/go-selinux/label/label.go
generated
vendored
Normal file
@ -0,0 +1,84 @@
|
|||||||
|
// +build !selinux !linux
|
||||||
|
|
||||||
|
package label
|
||||||
|
|
||||||
|
// InitLabels returns the process label and file labels to be used within
|
||||||
|
// the container. A list of options can be passed into this function to alter
|
||||||
|
// the labels.
|
||||||
|
func InitLabels(options []string) (string, string, error) {
|
||||||
|
return "", "", nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func GetROMountLabel() string {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
func GenLabels(options string) (string, string, error) {
|
||||||
|
return "", "", nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func FormatMountLabel(src string, mountLabel string) string {
|
||||||
|
return src
|
||||||
|
}
|
||||||
|
|
||||||
|
func SetProcessLabel(processLabel string) error {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func GetFileLabel(path string) (string, error) {
|
||||||
|
return "", nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func SetFileLabel(path string, fileLabel string) error {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func SetFileCreateLabel(fileLabel string) error {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func Relabel(path string, fileLabel string, shared bool) error {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func GetPidLabel(pid int) (string, error) {
|
||||||
|
return "", nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func Init() {
|
||||||
|
}
|
||||||
|
|
||||||
|
func ReserveLabel(label string) error {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func ReleaseLabel(label string) error {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DupSecOpt takes a process label and returns security options that
|
||||||
|
// can be used to set duplicate labels on future container processes
|
||||||
|
func DupSecOpt(src string) []string {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DisableSecOpt returns a security opt that can disable labeling
|
||||||
|
// support for future container processes
|
||||||
|
func DisableSecOpt() []string {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Validate checks that the label does not include unexpected options
|
||||||
|
func Validate(label string) error {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// RelabelNeeded checks whether the user requested a relabel
|
||||||
|
func RelabelNeeded(label string) bool {
|
||||||
|
return false
|
||||||
|
}
|
||||||
|
|
||||||
|
// IsShared checks that the label includes a "shared" mark
|
||||||
|
func IsShared(label string) bool {
|
||||||
|
return false
|
||||||
|
}
|
||||||
204
vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
generated
vendored
Normal file
204
vendor/github.com/opencontainers/selinux/go-selinux/label/label_selinux.go
generated
vendored
Normal file
@ -0,0 +1,204 @@
|
|||||||
|
// +build selinux,linux
|
||||||
|
|
||||||
|
package label
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/opencontainers/selinux/go-selinux"
|
||||||
|
)
|
||||||
|
|
||||||
|
// Valid Label Options
|
||||||
|
var validOptions = map[string]bool{
|
||||||
|
"disable": true,
|
||||||
|
"type": true,
|
||||||
|
"user": true,
|
||||||
|
"role": true,
|
||||||
|
"level": true,
|
||||||
|
}
|
||||||
|
|
||||||
|
var ErrIncompatibleLabel = fmt.Errorf("Bad SELinux option z and Z can not be used together")
|
||||||
|
|
||||||
|
// InitLabels returns the process label and file labels to be used within
|
||||||
|
// the container. A list of options can be passed into this function to alter
|
||||||
|
// the labels. The labels returned will include a random MCS String, that is
|
||||||
|
// guaranteed to be unique.
|
||||||
|
func InitLabels(options []string) (string, string, error) {
|
||||||
|
if !selinux.GetEnabled() {
|
||||||
|
return "", "", nil
|
||||||
|
}
|
||||||
|
processLabel, mountLabel := selinux.ContainerLabels()
|
||||||
|
if processLabel != "" {
|
||||||
|
pcon := selinux.NewContext(processLabel)
|
||||||
|
mcon := selinux.NewContext(mountLabel)
|
||||||
|
for _, opt := range options {
|
||||||
|
if opt == "disable" {
|
||||||
|
return "", "", nil
|
||||||
|
}
|
||||||
|
if i := strings.Index(opt, ":"); i == -1 {
|
||||||
|
return "", "", fmt.Errorf("Bad label option %q, valid options 'disable' or \n'user, role, level, type' followed by ':' and a value", opt)
|
||||||
|
}
|
||||||
|
con := strings.SplitN(opt, ":", 2)
|
||||||
|
if !validOptions[con[0]] {
|
||||||
|
return "", "", fmt.Errorf("Bad label option %q, valid options 'disable, user, role, level, type'", con[0])
|
||||||
|
|
||||||
|
}
|
||||||
|
pcon[con[0]] = con[1]
|
||||||
|
if con[0] == "level" || con[0] == "user" {
|
||||||
|
mcon[con[0]] = con[1]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
processLabel = pcon.Get()
|
||||||
|
mountLabel = mcon.Get()
|
||||||
|
}
|
||||||
|
return processLabel, mountLabel, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func ROMountLabel() string {
|
||||||
|
return selinux.ROFileLabel()
|
||||||
|
}
|
||||||
|
|
||||||
|
// DEPRECATED: The GenLabels function is only to be used during the transition to the official API.
|
||||||
|
func GenLabels(options string) (string, string, error) {
|
||||||
|
return InitLabels(strings.Fields(options))
|
||||||
|
}
|
||||||
|
|
||||||
|
// FormatMountLabel returns a string to be used by the mount command.
|
||||||
|
// The format of this string will be used to alter the labeling of the mountpoint.
|
||||||
|
// The string returned is suitable to be used as the options field of the mount command.
|
||||||
|
// If you need to have additional mount point options, you can pass them in as
|
||||||
|
// the first parameter. Second parameter is the label that you wish to apply
|
||||||
|
// to all content in the mount point.
|
||||||
|
func FormatMountLabel(src, mountLabel string) string {
|
||||||
|
if mountLabel != "" {
|
||||||
|
switch src {
|
||||||
|
case "":
|
||||||
|
src = fmt.Sprintf("context=%q", mountLabel)
|
||||||
|
default:
|
||||||
|
src = fmt.Sprintf("%s,context=%q", src, mountLabel)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return src
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetProcessLabel takes a process label and tells the kernel to assign the
|
||||||
|
// label to the next program executed by the current process.
|
||||||
|
func SetProcessLabel(processLabel string) error {
|
||||||
|
if processLabel == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return selinux.SetExecLabel(processLabel)
|
||||||
|
}
|
||||||
|
|
||||||
|
// ProcessLabel returns the process label that the kernel will assign
|
||||||
|
// to the next program executed by the current process. If "" is returned
|
||||||
|
// this indicates that the default labeling will happen for the process.
|
||||||
|
func ProcessLabel() (string, error) {
|
||||||
|
return selinux.ExecLabel()
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetFileLabel returns the label for specified path
|
||||||
|
func FileLabel(path string) (string, error) {
|
||||||
|
return selinux.FileLabel(path)
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetFileLabel modifies the "path" label to the specified file label
|
||||||
|
func SetFileLabel(path string, fileLabel string) error {
|
||||||
|
if selinux.GetEnabled() && fileLabel != "" {
|
||||||
|
return selinux.SetFileLabel(path, fileLabel)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetFileCreateLabel tells the kernel the label for all files to be created
|
||||||
|
func SetFileCreateLabel(fileLabel string) error {
|
||||||
|
if selinux.GetEnabled() {
|
||||||
|
return selinux.SetFSCreateLabel(fileLabel)
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Relabel changes the label of path to the filelabel string.
|
||||||
|
// It changes the MCS label to s0 if shared is true.
|
||||||
|
// This will allow all containers to share the content.
|
||||||
|
func Relabel(path string, fileLabel string, shared bool) error {
|
||||||
|
if !selinux.GetEnabled() {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if fileLabel == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
exclude_paths := map[string]bool{"/": true, "/usr": true, "/etc": true}
|
||||||
|
if exclude_paths[path] {
|
||||||
|
return fmt.Errorf("SELinux relabeling of %s is not allowed", path)
|
||||||
|
}
|
||||||
|
|
||||||
|
if shared {
|
||||||
|
c := selinux.NewContext(fileLabel)
|
||||||
|
c["level"] = "s0"
|
||||||
|
fileLabel = c.Get()
|
||||||
|
}
|
||||||
|
if err := selinux.Chcon(path, fileLabel, true); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// PidLabel will return the label of the process running with the specified pid
|
||||||
|
func PidLabel(pid int) (string, error) {
|
||||||
|
return selinux.PidLabel(pid)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Init initialises the labeling system
|
||||||
|
func Init() {
|
||||||
|
selinux.GetEnabled()
|
||||||
|
}
|
||||||
|
|
||||||
|
// ReserveLabel will record the fact that the MCS label has already been used.
|
||||||
|
// This will prevent InitLabels from using the MCS label in a newly created
|
||||||
|
// container
|
||||||
|
func ReserveLabel(label string) error {
|
||||||
|
selinux.ReserveLabel(label)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ReleaseLabel will remove the reservation of the MCS label.
|
||||||
|
// This will allow InitLabels to use the MCS label in a newly created
|
||||||
|
// containers
|
||||||
|
func ReleaseLabel(label string) error {
|
||||||
|
selinux.ReleaseLabel(label)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// DupSecOpt takes a process label and returns security options that
|
||||||
|
// can be used to set duplicate labels on future container processes
|
||||||
|
func DupSecOpt(src string) []string {
|
||||||
|
return selinux.DupSecOpt(src)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DisableSecOpt returns a security opt that can disable labeling
|
||||||
|
// support for future container processes
|
||||||
|
func DisableSecOpt() []string {
|
||||||
|
return selinux.DisableSecOpt()
|
||||||
|
}
|
||||||
|
|
||||||
|
// Validate checks that the label does not include unexpected options
|
||||||
|
func Validate(label string) error {
|
||||||
|
if strings.Contains(label, "z") && strings.Contains(label, "Z") {
|
||||||
|
return ErrIncompatibleLabel
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// RelabelNeeded checks whether the user requested a relabel
|
||||||
|
func RelabelNeeded(label string) bool {
|
||||||
|
return strings.Contains(label, "z") || strings.Contains(label, "Z")
|
||||||
|
}
|
||||||
|
|
||||||
|
// IsShared checks that the label includes a "shared" mark
|
||||||
|
func IsShared(label string) bool {
|
||||||
|
return strings.Contains(label, "z")
|
||||||
|
}
|
||||||
593
vendor/github.com/opencontainers/selinux/go-selinux/selinux.go
generated
vendored
Normal file
593
vendor/github.com/opencontainers/selinux/go-selinux/selinux.go
generated
vendored
Normal file
@ -0,0 +1,593 @@
|
|||||||
|
// +build linux
|
||||||
|
|
||||||
|
package selinux
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bufio"
|
||||||
|
"crypto/rand"
|
||||||
|
"encoding/binary"
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"regexp"
|
||||||
|
"strconv"
|
||||||
|
"strings"
|
||||||
|
"sync"
|
||||||
|
"syscall"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// Enforcing constant indicate SELinux is in enforcing mode
|
||||||
|
Enforcing = 1
|
||||||
|
// Permissive constant to indicate SELinux is in permissive mode
|
||||||
|
Permissive = 0
|
||||||
|
// Disabled constant to indicate SELinux is disabled
|
||||||
|
Disabled = -1
|
||||||
|
selinuxDir = "/etc/selinux/"
|
||||||
|
selinuxConfig = selinuxDir + "config"
|
||||||
|
selinuxTypeTag = "SELINUXTYPE"
|
||||||
|
selinuxTag = "SELINUX"
|
||||||
|
selinuxPath = "/sys/fs/selinux"
|
||||||
|
xattrNameSelinux = "security.selinux"
|
||||||
|
stRdOnly = 0x01
|
||||||
|
)
|
||||||
|
|
||||||
|
type selinuxState struct {
|
||||||
|
enabledSet bool
|
||||||
|
enabled bool
|
||||||
|
selinuxfsSet bool
|
||||||
|
selinuxfs string
|
||||||
|
mcsList map[string]bool
|
||||||
|
sync.Mutex
|
||||||
|
}
|
||||||
|
|
||||||
|
var (
|
||||||
|
assignRegex = regexp.MustCompile(`^([^=]+)=(.*)$`)
|
||||||
|
state = selinuxState{
|
||||||
|
mcsList: make(map[string]bool),
|
||||||
|
}
|
||||||
|
)
|
||||||
|
|
||||||
|
// Context is a representation of the SELinux label broken into 4 parts
|
||||||
|
type Context map[string]string
|
||||||
|
|
||||||
|
func (s *selinuxState) setEnable(enabled bool) bool {
|
||||||
|
s.Lock()
|
||||||
|
defer s.Unlock()
|
||||||
|
s.enabledSet = true
|
||||||
|
s.enabled = enabled
|
||||||
|
return s.enabled
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *selinuxState) getEnabled() bool {
|
||||||
|
s.Lock()
|
||||||
|
enabled := s.enabled
|
||||||
|
enabledSet := s.enabledSet
|
||||||
|
s.Unlock()
|
||||||
|
if enabledSet {
|
||||||
|
return enabled
|
||||||
|
}
|
||||||
|
|
||||||
|
enabled = false
|
||||||
|
if fs := getSelinuxMountPoint(); fs != "" {
|
||||||
|
if con, _ := CurrentLabel(); con != "kernel" {
|
||||||
|
enabled = true
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return s.setEnable(enabled)
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetDisabled disables selinux support for the package
|
||||||
|
func SetDisabled() {
|
||||||
|
state.setEnable(false)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *selinuxState) setSELinuxfs(selinuxfs string) string {
|
||||||
|
s.Lock()
|
||||||
|
defer s.Unlock()
|
||||||
|
s.selinuxfsSet = true
|
||||||
|
s.selinuxfs = selinuxfs
|
||||||
|
return s.selinuxfs
|
||||||
|
}
|
||||||
|
|
||||||
|
func (s *selinuxState) getSELinuxfs() string {
|
||||||
|
s.Lock()
|
||||||
|
selinuxfs := s.selinuxfs
|
||||||
|
selinuxfsSet := s.selinuxfsSet
|
||||||
|
s.Unlock()
|
||||||
|
if selinuxfsSet {
|
||||||
|
return selinuxfs
|
||||||
|
}
|
||||||
|
|
||||||
|
selinuxfs = ""
|
||||||
|
f, err := os.Open("/proc/self/mountinfo")
|
||||||
|
if err != nil {
|
||||||
|
return selinuxfs
|
||||||
|
}
|
||||||
|
defer f.Close()
|
||||||
|
|
||||||
|
scanner := bufio.NewScanner(f)
|
||||||
|
for scanner.Scan() {
|
||||||
|
txt := scanner.Text()
|
||||||
|
// Safe as mountinfo encodes mountpoints with spaces as \040.
|
||||||
|
sepIdx := strings.Index(txt, " - ")
|
||||||
|
if sepIdx == -1 {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if !strings.Contains(txt[sepIdx:], "selinuxfs") {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
fields := strings.Split(txt, " ")
|
||||||
|
if len(fields) < 5 {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
selinuxfs = fields[4]
|
||||||
|
break
|
||||||
|
}
|
||||||
|
|
||||||
|
if selinuxfs != "" {
|
||||||
|
var buf syscall.Statfs_t
|
||||||
|
syscall.Statfs(selinuxfs, &buf)
|
||||||
|
if (buf.Flags & stRdOnly) == 1 {
|
||||||
|
selinuxfs = ""
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return s.setSELinuxfs(selinuxfs)
|
||||||
|
}
|
||||||
|
|
||||||
|
// getSelinuxMountPoint returns the path to the mountpoint of an selinuxfs
|
||||||
|
// filesystem or an empty string if no mountpoint is found. Selinuxfs is
|
||||||
|
// a proc-like pseudo-filesystem that exposes the selinux policy API to
|
||||||
|
// processes. The existence of an selinuxfs mount is used to determine
|
||||||
|
// whether selinux is currently enabled or not.
|
||||||
|
func getSelinuxMountPoint() string {
|
||||||
|
return state.getSELinuxfs()
|
||||||
|
}
|
||||||
|
|
||||||
|
// GetEnabled returns whether selinux is currently enabled.
|
||||||
|
func GetEnabled() bool {
|
||||||
|
return state.getEnabled()
|
||||||
|
}
|
||||||
|
|
||||||
|
func readConfig(target string) (value string) {
|
||||||
|
var (
|
||||||
|
val, key string
|
||||||
|
bufin *bufio.Reader
|
||||||
|
)
|
||||||
|
|
||||||
|
in, err := os.Open(selinuxConfig)
|
||||||
|
if err != nil {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
defer in.Close()
|
||||||
|
|
||||||
|
bufin = bufio.NewReader(in)
|
||||||
|
|
||||||
|
for done := false; !done; {
|
||||||
|
var line string
|
||||||
|
if line, err = bufin.ReadString('\n'); err != nil {
|
||||||
|
if err != io.EOF {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
done = true
|
||||||
|
}
|
||||||
|
line = strings.TrimSpace(line)
|
||||||
|
if len(line) == 0 {
|
||||||
|
// Skip blank lines
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if line[0] == ';' || line[0] == '#' {
|
||||||
|
// Skip comments
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if groups := assignRegex.FindStringSubmatch(line); groups != nil {
|
||||||
|
key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2])
|
||||||
|
if key == target {
|
||||||
|
return strings.Trim(val, "\"")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
func getSELinuxPolicyRoot() string {
|
||||||
|
return selinuxDir + readConfig(selinuxTypeTag)
|
||||||
|
}
|
||||||
|
|
||||||
|
func readCon(name string) (string, error) {
|
||||||
|
var val string
|
||||||
|
|
||||||
|
in, err := os.Open(name)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
defer in.Close()
|
||||||
|
|
||||||
|
_, err = fmt.Fscanf(in, "%s", &val)
|
||||||
|
return val, err
|
||||||
|
}
|
||||||
|
|
||||||
|
// SetFileLabel sets the SELinux label for this path or returns an error.
|
||||||
|
func SetFileLabel(path string, label string) error {
|
||||||
|
return lsetxattr(path, xattrNameSelinux, []byte(label), 0)
|
||||||
|
}
|
||||||
|
|
||||||
|
// FileLabel returns the SELinux label for this path or returns an error.
|
||||||
|
func FileLabel(path string) (string, error) {
|
||||||
|
label, err := lgetxattr(path, xattrNameSelinux)
|
||||||
|
if err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
// Trim the NUL byte at the end of the byte buffer, if present.
|
||||||
|
if len(label) > 0 && label[len(label)-1] == '\x00' {
|
||||||
|
label = label[:len(label)-1]
|
||||||
|
}
|
||||||
|
return string(label), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
SetFSCreateLabel tells kernel the label to create all file system objects
|
||||||
|
created by this task. Setting label="" to return to default.
|
||||||
|
*/
|
||||||
|
func SetFSCreateLabel(label string) error {
|
||||||
|
return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid()), label)
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
FSCreateLabel returns the default label the kernel which the kernel is using
|
||||||
|
for file system objects created by this task. "" indicates default.
|
||||||
|
*/
|
||||||
|
func FSCreateLabel() (string, error) {
|
||||||
|
return readCon(fmt.Sprintf("/proc/self/task/%d/attr/fscreate", syscall.Gettid()))
|
||||||
|
}
|
||||||
|
|
||||||
|
// CurrentLabel returns the SELinux label of the current process thread, or an error.
|
||||||
|
func CurrentLabel() (string, error) {
|
||||||
|
return readCon(fmt.Sprintf("/proc/self/task/%d/attr/current", syscall.Gettid()))
|
||||||
|
}
|
||||||
|
|
||||||
|
// PidLabel returns the SELinux label of the given pid, or an error.
|
||||||
|
func PidLabel(pid int) (string, error) {
|
||||||
|
return readCon(fmt.Sprintf("/proc/%d/attr/current", pid))
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
ExecLabel returns the SELinux label that the kernel will use for any programs
|
||||||
|
that are executed by the current process thread, or an error.
|
||||||
|
*/
|
||||||
|
func ExecLabel() (string, error) {
|
||||||
|
return readCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid()))
|
||||||
|
}
|
||||||
|
|
||||||
|
func writeCon(name string, val string) error {
|
||||||
|
out, err := os.OpenFile(name, os.O_WRONLY, 0)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
defer out.Close()
|
||||||
|
|
||||||
|
if val != "" {
|
||||||
|
_, err = out.Write([]byte(val))
|
||||||
|
} else {
|
||||||
|
_, err = out.Write(nil)
|
||||||
|
}
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
SetExecLabel sets the SELinux label that the kernel will use for any programs
|
||||||
|
that are executed by the current process thread, or an error.
|
||||||
|
*/
|
||||||
|
func SetExecLabel(label string) error {
|
||||||
|
return writeCon(fmt.Sprintf("/proc/self/task/%d/attr/exec", syscall.Gettid()), label)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Get returns the Context as a string
|
||||||
|
func (c Context) Get() string {
|
||||||
|
return fmt.Sprintf("%s:%s:%s:%s", c["user"], c["role"], c["type"], c["level"])
|
||||||
|
}
|
||||||
|
|
||||||
|
// NewContext creates a new Context struct from the specified label
|
||||||
|
func NewContext(label string) Context {
|
||||||
|
c := make(Context)
|
||||||
|
|
||||||
|
if len(label) != 0 {
|
||||||
|
con := strings.SplitN(label, ":", 4)
|
||||||
|
c["user"] = con[0]
|
||||||
|
c["role"] = con[1]
|
||||||
|
c["type"] = con[2]
|
||||||
|
c["level"] = con[3]
|
||||||
|
}
|
||||||
|
return c
|
||||||
|
}
|
||||||
|
|
||||||
|
// ReserveLabel reserves the MLS/MCS level component of the specified label
|
||||||
|
func ReserveLabel(label string) {
|
||||||
|
if len(label) != 0 {
|
||||||
|
con := strings.SplitN(label, ":", 4)
|
||||||
|
mcsAdd(con[3])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func selinuxEnforcePath() string {
|
||||||
|
return fmt.Sprintf("%s/enforce", selinuxPath)
|
||||||
|
}
|
||||||
|
|
||||||
|
// EnforceMode returns the current SELinux mode Enforcing, Permissive, Disabled
|
||||||
|
func EnforceMode() int {
|
||||||
|
var enforce int
|
||||||
|
|
||||||
|
enforceS, err := readCon(selinuxEnforcePath())
|
||||||
|
if err != nil {
|
||||||
|
return -1
|
||||||
|
}
|
||||||
|
|
||||||
|
enforce, err = strconv.Atoi(string(enforceS))
|
||||||
|
if err != nil {
|
||||||
|
return -1
|
||||||
|
}
|
||||||
|
return enforce
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
SetEnforceMode sets the current SELinux mode Enforcing, Permissive.
|
||||||
|
Disabled is not valid, since this needs to be set at boot time.
|
||||||
|
*/
|
||||||
|
func SetEnforceMode(mode int) error {
|
||||||
|
return writeCon(selinuxEnforcePath(), fmt.Sprintf("%d", mode))
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
DefaultEnforceMode returns the systems default SELinux mode Enforcing,
|
||||||
|
Permissive or Disabled. Note this is is just the default at boot time.
|
||||||
|
EnforceMode tells you the systems current mode.
|
||||||
|
*/
|
||||||
|
func DefaultEnforceMode() int {
|
||||||
|
switch readConfig(selinuxTag) {
|
||||||
|
case "enforcing":
|
||||||
|
return Enforcing
|
||||||
|
case "permissive":
|
||||||
|
return Permissive
|
||||||
|
}
|
||||||
|
return Disabled
|
||||||
|
}
|
||||||
|
|
||||||
|
func mcsAdd(mcs string) error {
|
||||||
|
state.Lock()
|
||||||
|
defer state.Unlock()
|
||||||
|
if state.mcsList[mcs] {
|
||||||
|
return fmt.Errorf("MCS Label already exists")
|
||||||
|
}
|
||||||
|
state.mcsList[mcs] = true
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func mcsDelete(mcs string) {
|
||||||
|
state.Lock()
|
||||||
|
defer state.Unlock()
|
||||||
|
state.mcsList[mcs] = false
|
||||||
|
}
|
||||||
|
|
||||||
|
func intToMcs(id int, catRange uint32) string {
|
||||||
|
var (
|
||||||
|
SETSIZE = int(catRange)
|
||||||
|
TIER = SETSIZE
|
||||||
|
ORD = id
|
||||||
|
)
|
||||||
|
|
||||||
|
if id < 1 || id > 523776 {
|
||||||
|
return ""
|
||||||
|
}
|
||||||
|
|
||||||
|
for ORD > TIER {
|
||||||
|
ORD = ORD - TIER
|
||||||
|
TIER--
|
||||||
|
}
|
||||||
|
TIER = SETSIZE - TIER
|
||||||
|
ORD = ORD + TIER
|
||||||
|
return fmt.Sprintf("s0:c%d,c%d", TIER, ORD)
|
||||||
|
}
|
||||||
|
|
||||||
|
func uniqMcs(catRange uint32) string {
|
||||||
|
var (
|
||||||
|
n uint32
|
||||||
|
c1, c2 uint32
|
||||||
|
mcs string
|
||||||
|
)
|
||||||
|
|
||||||
|
for {
|
||||||
|
binary.Read(rand.Reader, binary.LittleEndian, &n)
|
||||||
|
c1 = n % catRange
|
||||||
|
binary.Read(rand.Reader, binary.LittleEndian, &n)
|
||||||
|
c2 = n % catRange
|
||||||
|
if c1 == c2 {
|
||||||
|
continue
|
||||||
|
} else {
|
||||||
|
if c1 > c2 {
|
||||||
|
c1, c2 = c2, c1
|
||||||
|
}
|
||||||
|
}
|
||||||
|
mcs = fmt.Sprintf("s0:c%d,c%d", c1, c2)
|
||||||
|
if err := mcsAdd(mcs); err != nil {
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
break
|
||||||
|
}
|
||||||
|
return mcs
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
ReleaseLabel will unreserve the MLS/MCS Level field of the specified label.
|
||||||
|
Allowing it to be used by another process.
|
||||||
|
*/
|
||||||
|
func ReleaseLabel(label string) {
|
||||||
|
if len(label) != 0 {
|
||||||
|
con := strings.SplitN(label, ":", 4)
|
||||||
|
mcsDelete(con[3])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
var roFileLabel string
|
||||||
|
|
||||||
|
// ROFileLabel returns the specified SELinux readonly file label
|
||||||
|
func ROFileLabel() (fileLabel string) {
|
||||||
|
return roFileLabel
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
ContainerLabels returns an allocated processLabel and fileLabel to be used for
|
||||||
|
container labeling by the calling process.
|
||||||
|
*/
|
||||||
|
func ContainerLabels() (processLabel string, fileLabel string) {
|
||||||
|
var (
|
||||||
|
val, key string
|
||||||
|
bufin *bufio.Reader
|
||||||
|
)
|
||||||
|
|
||||||
|
if !GetEnabled() {
|
||||||
|
return "", ""
|
||||||
|
}
|
||||||
|
lxcPath := fmt.Sprintf("%s/contexts/lxc_contexts", getSELinuxPolicyRoot())
|
||||||
|
in, err := os.Open(lxcPath)
|
||||||
|
if err != nil {
|
||||||
|
return "", ""
|
||||||
|
}
|
||||||
|
defer in.Close()
|
||||||
|
|
||||||
|
bufin = bufio.NewReader(in)
|
||||||
|
|
||||||
|
for done := false; !done; {
|
||||||
|
var line string
|
||||||
|
if line, err = bufin.ReadString('\n'); err != nil {
|
||||||
|
if err == io.EOF {
|
||||||
|
done = true
|
||||||
|
} else {
|
||||||
|
goto exit
|
||||||
|
}
|
||||||
|
}
|
||||||
|
line = strings.TrimSpace(line)
|
||||||
|
if len(line) == 0 {
|
||||||
|
// Skip blank lines
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if line[0] == ';' || line[0] == '#' {
|
||||||
|
// Skip comments
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
if groups := assignRegex.FindStringSubmatch(line); groups != nil {
|
||||||
|
key, val = strings.TrimSpace(groups[1]), strings.TrimSpace(groups[2])
|
||||||
|
if key == "process" {
|
||||||
|
processLabel = strings.Trim(val, "\"")
|
||||||
|
}
|
||||||
|
if key == "file" {
|
||||||
|
fileLabel = strings.Trim(val, "\"")
|
||||||
|
}
|
||||||
|
if key == "ro_file" {
|
||||||
|
roFileLabel = strings.Trim(val, "\"")
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if processLabel == "" || fileLabel == "" {
|
||||||
|
return "", ""
|
||||||
|
}
|
||||||
|
|
||||||
|
if roFileLabel == "" {
|
||||||
|
roFileLabel = fileLabel
|
||||||
|
}
|
||||||
|
exit:
|
||||||
|
mcs := uniqMcs(1024)
|
||||||
|
scon := NewContext(processLabel)
|
||||||
|
scon["level"] = mcs
|
||||||
|
processLabel = scon.Get()
|
||||||
|
scon = NewContext(fileLabel)
|
||||||
|
scon["level"] = mcs
|
||||||
|
fileLabel = scon.Get()
|
||||||
|
return processLabel, fileLabel
|
||||||
|
}
|
||||||
|
|
||||||
|
// SecurityCheckContext validates that the SELinux label is understood by the kernel
|
||||||
|
func SecurityCheckContext(val string) error {
|
||||||
|
return writeCon(fmt.Sprintf("%s.context", selinuxPath), val)
|
||||||
|
}
|
||||||
|
|
||||||
|
/*
|
||||||
|
CopyLevel returns a label with the MLS/MCS level from src label replaces on
|
||||||
|
the dest label.
|
||||||
|
*/
|
||||||
|
func CopyLevel(src, dest string) (string, error) {
|
||||||
|
if src == "" {
|
||||||
|
return "", nil
|
||||||
|
}
|
||||||
|
if err := SecurityCheckContext(src); err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
if err := SecurityCheckContext(dest); err != nil {
|
||||||
|
return "", err
|
||||||
|
}
|
||||||
|
scon := NewContext(src)
|
||||||
|
tcon := NewContext(dest)
|
||||||
|
mcsDelete(tcon["level"])
|
||||||
|
mcsAdd(scon["level"])
|
||||||
|
tcon["level"] = scon["level"]
|
||||||
|
return tcon.Get(), nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Prevent users from relabing system files
|
||||||
|
func badPrefix(fpath string) error {
|
||||||
|
var badprefixes = []string{"/usr"}
|
||||||
|
|
||||||
|
for _, prefix := range badprefixes {
|
||||||
|
if fpath == prefix || strings.HasPrefix(fpath, fmt.Sprintf("%s/", prefix)) {
|
||||||
|
return fmt.Errorf("relabeling content in %s is not allowed", prefix)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// Chcon changes the fpath file object to the SELinux label label.
|
||||||
|
// If the fpath is a directory and recurse is true Chcon will walk the
|
||||||
|
// directory tree setting the label
|
||||||
|
func Chcon(fpath string, label string, recurse bool) error {
|
||||||
|
if label == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
if err := badPrefix(fpath); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
callback := func(p string, info os.FileInfo, err error) error {
|
||||||
|
return SetFileLabel(p, label)
|
||||||
|
}
|
||||||
|
|
||||||
|
if recurse {
|
||||||
|
return filepath.Walk(fpath, callback)
|
||||||
|
}
|
||||||
|
|
||||||
|
return SetFileLabel(fpath, label)
|
||||||
|
}
|
||||||
|
|
||||||
|
// DupSecOpt takes an SELinux process label and returns security options that
|
||||||
|
// can will set the SELinux Type and Level for future container processes
|
||||||
|
func DupSecOpt(src string) []string {
|
||||||
|
if src == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
con := NewContext(src)
|
||||||
|
if con["user"] == "" ||
|
||||||
|
con["role"] == "" ||
|
||||||
|
con["type"] == "" ||
|
||||||
|
con["level"] == "" {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
return []string{"user:" + con["user"],
|
||||||
|
"role:" + con["role"],
|
||||||
|
"type:" + con["type"],
|
||||||
|
"level:" + con["level"]}
|
||||||
|
}
|
||||||
|
|
||||||
|
// DisableSecOpt returns a security opt that can be used to disabling SELinux
|
||||||
|
// labeling support for future container processes
|
||||||
|
func DisableSecOpt() []string {
|
||||||
|
return []string{"disable"}
|
||||||
|
}
|
||||||
78
vendor/github.com/opencontainers/selinux/go-selinux/xattrs.go
generated
vendored
Normal file
78
vendor/github.com/opencontainers/selinux/go-selinux/xattrs.go
generated
vendored
Normal file
@ -0,0 +1,78 @@
|
|||||||
|
// +build linux
|
||||||
|
|
||||||
|
package selinux
|
||||||
|
|
||||||
|
import (
|
||||||
|
"syscall"
|
||||||
|
"unsafe"
|
||||||
|
)
|
||||||
|
|
||||||
|
var _zero uintptr
|
||||||
|
|
||||||
|
// Returns a []byte slice if the xattr is set and nil otherwise
|
||||||
|
// Requires path and its attribute as arguments
|
||||||
|
func lgetxattr(path string, attr string) ([]byte, error) {
|
||||||
|
var sz int
|
||||||
|
pathBytes, err := syscall.BytePtrFromString(path)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
attrBytes, err := syscall.BytePtrFromString(attr)
|
||||||
|
if err != nil {
|
||||||
|
return nil, err
|
||||||
|
}
|
||||||
|
|
||||||
|
// Start with a 128 length byte array
|
||||||
|
sz = 128
|
||||||
|
dest := make([]byte, sz)
|
||||||
|
destBytes := unsafe.Pointer(&dest[0])
|
||||||
|
_sz, _, errno := syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0)
|
||||||
|
|
||||||
|
switch {
|
||||||
|
case errno == syscall.ENODATA:
|
||||||
|
return nil, errno
|
||||||
|
case errno == syscall.ENOTSUP:
|
||||||
|
return nil, errno
|
||||||
|
case errno == syscall.ERANGE:
|
||||||
|
// 128 byte array might just not be good enough,
|
||||||
|
// A dummy buffer is used ``uintptr(0)`` to get real size
|
||||||
|
// of the xattrs on disk
|
||||||
|
_sz, _, errno = syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(unsafe.Pointer(nil)), uintptr(0), 0, 0)
|
||||||
|
sz = int(_sz)
|
||||||
|
if sz < 0 {
|
||||||
|
return nil, errno
|
||||||
|
}
|
||||||
|
dest = make([]byte, sz)
|
||||||
|
destBytes := unsafe.Pointer(&dest[0])
|
||||||
|
_sz, _, errno = syscall.Syscall6(syscall.SYS_LGETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(destBytes), uintptr(len(dest)), 0, 0)
|
||||||
|
if errno != 0 {
|
||||||
|
return nil, errno
|
||||||
|
}
|
||||||
|
case errno != 0:
|
||||||
|
return nil, errno
|
||||||
|
}
|
||||||
|
sz = int(_sz)
|
||||||
|
return dest[:sz], nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func lsetxattr(path string, attr string, data []byte, flags int) error {
|
||||||
|
pathBytes, err := syscall.BytePtrFromString(path)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
attrBytes, err := syscall.BytePtrFromString(attr)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
var dataBytes unsafe.Pointer
|
||||||
|
if len(data) > 0 {
|
||||||
|
dataBytes = unsafe.Pointer(&data[0])
|
||||||
|
} else {
|
||||||
|
dataBytes = unsafe.Pointer(&_zero)
|
||||||
|
}
|
||||||
|
_, _, errno := syscall.Syscall6(syscall.SYS_LSETXATTR, uintptr(unsafe.Pointer(pathBytes)), uintptr(unsafe.Pointer(attrBytes)), uintptr(dataBytes), uintptr(len(data)), uintptr(flags), 0)
|
||||||
|
if errno != 0 {
|
||||||
|
return errno
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
Loading…
Reference in New Issue
Block a user