Re: [PATCH v2 1/4] Add SELinux policy for virt

On 4/26/21 7:39 PM, Daniel P. Berrangé wrote: > On Wed, Apr 07, 2021 at 07:08:34AM -0700, Vit Mojzis wrote: > > From: Nikola Knazekova <nknazeko(a)redhat.com&gt; > > > > SELinux policy was created for: > > > > Hypervisor drivers: > > - virtqemud (QEMU/KVM) > > - virtlxcd (LXC) > > - virtvboxd (VirtualBox) > > > > Secondary drivers: > > - virtstoraged (host storage mgmt) > > - virtnetworkd (virtual network mgmt) > > - virtinterface (network interface mgmt) > > - virtnodedevd (physical device mgmt) > > - virtsecretd (security credential mgmt) > > - virtnwfilterd (ip[6]tables/ebtables mgmt) > > - virtproxyd (proxy daemon) > > > > SELinux policy for virtvxz and virtxend has not been created yet, because I wasn't able to reproduce AVC messages. These drivers run in unconfined_domain until the AVC messages are reproduced internally and policy for these drivers is made. > > > > Signed-off-by: Nikola Knazekova <nknazeko(a)redhat.com&gt; > > --- > > libvirt.spec.in | 64 ++ > > selinux/virt.fc | 111 +++ > > selinux/virt.if | 1984 ++++++++++++++++++++++++++++++++++++++++++++ > > selinux/virt.te | 2086 +++++++++++++++++++++++++++++++++++++++++++++++ > > 4 files changed, 4245 insertions(+) > > create mode 100644 selinux/virt.fc > > create mode 100644 selinux/virt.if > > create mode 100644 selinux/virt.te > I was expecting to see the /etc/selinux/targeted/contexts/ files > that belong to the virt policy included as well. Those are compiled from the whole policy and would not be created without the corresponding selinux-policy-* package.

> > diff --git a/selinux/virt.te b/selinux/virt.te > > new file mode 100644 > > index 0000000000..59dedb8754 > > --- /dev/null > > +++ b/selinux/virt.te > > @@ -0,0 +1,2086 @@ > > +policy_module(virt, 1.5.0) > Is there some include file syntax we can use with this so > that we can split it up. I'm not asking you to split it, > but I'll later want to make it have one file for each daemon > and a few files for the common pieces, to make this easier > to manage. I'm not aware of any include syntax other than .if files. In theory you could use multiple interface files, each containing an interface covering a single daemon. All of those interfaces would then be "called" from virt.te. Other than that you'd need to have multiple policy modules in order to use multiple .te files.