Re: [PATCH v2] Add SELinux policy for virt

On Wed, Apr 07, 2021 at 06:14:58AM -0700, Vit Mojzis wrote: > Sorry for the long delay. This is our first request to ship a policy for > multiple selinux stores (targeted, mls and minimum). > > Changes: > * Replace all selinux-policy-%{policytype} dependencies with selinux-policy-base > * Add Ghost files representing installed policy modules in all policy stores > * Rewrite policy compilation script in python > * Compile the policy module twice (1 version for targeted/minimum - with > enable_mcs, and 1 for mls - with enable_mls) > * Manage policy (un)installation using triggers based on which policy > type is available > > The new policy was only tested in "targeted" mode so far and we'll need to make > sure it works properly in "mls". As for "minimum", we know it will not > work properly (as is the case of the current policy) by default (some > other "contrib" policy modules need to be enabled). > I'd argue there is no point trying to get it to work in "minimum", > mostly because it (minimum) will be retired soon. Running a build with this seris causes a tonne of warning messages on the console: [1310/1319] Generating virt.pp with a custom command /usr/share/selinux/devel/include/services/container.if:13: Error: duplicate definition of container_runtime_domtrans(). Original definition on 13. /usr/share/selinux/devel/include/services/container.if:40: Error: duplicate definition of container_runtime_run(). Original definition on 40. /usr/share/selinux/devel/include/services/container.if:61: Error: duplicate definition of container_runtime_exec(). Original definition on 61. /usr/share/selinux/devel/include/services/container.if:80: Error: duplicate definition of container_read_state(). Original definition on 80. /usr/share/selinux/devel/include/services/container.if:98: Error: duplicate definition of container_search_lib(). Original definition on 98. /usr/share/selinux/devel/include/services/container.if:117: Error: duplicate definition of container_exec_lib(). Original definition on 117. /usr/share/selinux/devel/include/services/container.if:136: Error: duplicate definition of container_read_lib_files(). Original definition on 136. /usr/share/selinux/devel/include/services/container.if:155: Error: duplicate definition of container_read_share_files(). Original definition on 155. /usr/share/selinux/devel/include/services/container.if:176: Error: duplicate definition of container_runtime_read_tmpfs_files(). Original definition on 176. /usr/share/selinux/devel/include/services/container.if:197: Error: duplicate definition of container_manage_share_files(). Original definition on 197. /usr/share/selinux/devel/include/services/container.if:218: Error: duplicate definition of container_manage_share_dirs(). Original definition on 218. /usr/share/selinux/devel/include/services/container.if:238: Error: duplicate definition of container_exec_share_files(). Original definition on 238. /usr/share/selinux/devel/include/services/container.if:256: Error: duplicate definition of container_manage_config_files(). Original definition on 256. /usr/share/selinux/devel/include/services/container.if:275: Error: duplicate definition of container_manage_lib_files(). Original definition on 275. /usr/share/selinux/devel/include/services/container.if:295: Error: duplicate definition of container_manage_files(). Original definition on 295. /usr/share/selinux/devel/include/services/container.if:314: Error: duplicate definition of container_manage_dirs(). Original definition on 314. /usr/share/selinux/devel/include/services/container.if:332: Error: duplicate definition of container_manage_lib_dirs(). Original definition on 332. /usr/share/selinux/devel/include/services/container.if:368: Error: duplicate definition of container_lib_filetrans(). Original definition on 368. /usr/share/selinux/devel/include/services/container.if:386: Error: duplicate definition of container_read_pid_files(). Original definition on 386. /usr/share/selinux/devel/include/services/container.if:405: Error: duplicate definition of container_systemctl(). Original definition on 405. /usr/share/selinux/devel/include/services/container.if:430: Error: duplicate definition of container_rw_sem(). Original definition on 430. /usr/share/selinux/devel/include/services/container.if:449: Error: duplicate definition of container_append_file(). Original definition on 449. /usr/share/selinux/devel/include/services/container.if:467: Error: duplicate definition of container_use_ptys(). Original definition on 467. /usr/share/selinux/devel/include/services/container.if:485: Error: duplicate definition of container_filetrans_named_content(). Original definition on 485. /usr/share/selinux/devel/include/services/container.if:549: Error: duplicate definition of container_stream_connect(). Original definition on 549. /usr/share/selinux/devel/include/services/container.if:570: Error: duplicate definition of container_spc_stream_connect(). Original definition on 570. /usr/share/selinux/devel/include/services/container.if:591: Error: duplicate definition of container_admin(). Original definition on 591. /usr/share/selinux/devel/include/services/container.if:638: Error: duplicate definition of container_auth_domtrans(). Original definition on 638. /usr/share/selinux/devel/include/services/container.if:657: Error: duplicate definition of container_auth_exec(). Original definition on 657. /usr/share/selinux/devel/include/services/container.if:676: Error: duplicate definition of container_auth_stream_connect(). Original definition on 676. /usr/share/selinux/devel/include/services/container.if:695: Error: duplicate definition of container_runtime_typebounds(). Original definition on 695. /usr/share/selinux/devel/include/services/container.if:714: Error: duplicate definition of container_runtime_entrypoint(). Original definition on 714. /usr/share/selinux/devel/include/services/container.if:721: Error: duplicate definition of docker_exec_lib(). Original definition on 721. /usr/share/selinux/devel/include/services/container.if:725: Error: duplicate definition of docker_read_share_files(). Original definition on 725. /usr/share/selinux/devel/include/services/container.if:729: Error: duplicate definition of docker_exec_share_files(). Original definition on 729. /usr/share/selinux/devel/include/services/container.if:733: Error: duplicate definition of docker_manage_lib_files(). Original definition on 733. /usr/share/selinux/devel/include/services/container.if:738: Error: duplicate definition of docker_manage_lib_dirs(). Original definition on 738. /usr/share/selinux/devel/include/services/container.if:742: Error: duplicate definition of docker_lib_filetrans(). Original definition on 742. /usr/share/selinux/devel/include/services/container.if:746: Error: duplicate definition of docker_read_pid_files(). Original definition on 746. /usr/share/selinux/devel/include/services/container.if:750: Error: duplicate definition of docker_systemctl(). Original definition on 750. /usr/share/selinux/devel/include/services/container.if:754: Error: duplicate definition of docker_use_ptys(). Original definition on 754. /usr/share/selinux/devel/include/services/container.if:758: Error: duplicate definition of docker_stream_connect(). Original definition on 758. /usr/share/selinux/devel/include/services/container.if:762: Error: duplicate definition of docker_spc_stream_connect(). Original definition on 762. /usr/share/selinux/devel/include/services/container.if:776: Error: duplicate definition of container_spc_read_state(). Original definition on 776. /usr/share/selinux/devel/include/services/container.if:795: Error: duplicate definition of container_runtime_domain_template(). Original definition on 795. /usr/share/selinux/devel/include/services/container.if:833: Error: duplicate definition of container_domain_template(). Original definition on 833. /usr/share/selinux/devel/include/services/container.if:861: Error: duplicate definition of container_spc_rw_pipes(). Original definition on 861. ../selinux/virt.if:13: Error: duplicate definition of virt_stub_lxc(). Original definition on 13. ../selinux/virt.if:29: Error: duplicate definition of virt_stub_svirt_sandbox_domain(). Original definition on 29. ../selinux/virt.if:45: Error: duplicate definition of virt_stub_container_image(). Original definition on 45. ../selinux/virt.if:51: Error: duplicate definition of virt_stub_svirt_sandbox_file(). Original definition on 51. ../selinux/virt.if:69: Error: duplicate definition of virt_domain_template(). Original definition on 69. ../selinux/virt.if:206: Error: duplicate definition of virt_image(). Original definition on 112. ../selinux/virt.if:228: Error: duplicate definition of virt_getattr_exec(). Original definition on 134. ../selinux/virt.if:248: Error: duplicate definition of virt_domtrans(). Original definition on 152. ../selinux/virt.if:266: Error: duplicate definition of virt_exec(). Original definition on 170. ../selinux/virt.if:286: Error: duplicate definition of virt_stream_connect(). Original definition on 205. ../selinux/virt.if:328: Error: duplicate definition of virt_stream_connect_svirt(). Original definition on 224. ../selinux/virt.if:348: Error: duplicate definition of virt_rw_stream_sockets_svirt(). Original definition on 244. ../selinux/virt.if:366: Error: duplicate definition of virt_attach_tun_iface(). Original definition on 262. ../selinux/virt.if:387: Error: duplicate definition of virt_attach_sandbox_tun_iface(). Original definition on 281. ../selinux/virt.if:406: Error: duplicate definition of virt_read_config(). Original definition on 300. ../selinux/virt.if:427: Error: duplicate definition of virt_manage_config(). Original definition on 321. ../selinux/virt.if:448: Error: duplicate definition of virt_getattr_content(). Original definition on 342. ../selinux/virt.if:466: Error: duplicate definition of virt_read_content(). Original definition on 360. ../selinux/virt.if:504: Error: duplicate definition of virt_write_content(). Original definition on 398. ../selinux/virt.if:522: Error: duplicate definition of virt_read_pid_symlinks(). Original definition on 416. ../selinux/virt.if:543: Error: duplicate definition of virt_read_pid_files(). Original definition on 435. ../selinux/virt.if:566: Error: duplicate definition of virt_manage_pid_dirs(). Original definition on 455. ../selinux/virt.if:590: Error: duplicate definition of virt_manage_pid_files(). Original definition on 477. ../selinux/virt.if:630: Error: duplicate definition of virt_pid_filetrans(). Original definition on 515. ../selinux/virt.if:650: Error: duplicate definition of virt_search_lib(). Original definition on 533. ../selinux/virt.if:669: Error: duplicate definition of virt_read_lib_files(). Original definition on 552. ../selinux/virt.if:690: Error: duplicate definition of virt_dontaudit_read_lib_files(). Original definition on 573. ../selinux/virt.if:709: Error: duplicate definition of virt_manage_lib_files(). Original definition on 592. ../selinux/virt.if:729: Error: duplicate definition of virt_read_log(). Original definition on 612. ../selinux/virt.if:749: Error: duplicate definition of virt_append_log(). Original definition on 632. ../selinux/virt.if:768: Error: duplicate definition of virt_manage_log(). Original definition on 651. ../selinux/virt.if:788: Error: duplicate definition of virt_getattr_images(). Original definition on 671. ../selinux/virt.if:807: Error: duplicate definition of virt_search_images(). Original definition on 690. ../selinux/virt.if:826: Error: duplicate definition of virt_read_images(). Original definition on 709. ../selinux/virt.if:863: Error: duplicate definition of virt_read_blk_images(). Original definition on 746. ../selinux/virt.if:881: Error: duplicate definition of virt_rw_chr_files(). Original definition on 764. ../selinux/virt.if:900: Error: duplicate definition of virt_manage_cache(). Original definition on 783. ../selinux/virt.if:921: Error: duplicate definition of virt_manage_images(). Original definition on 804. ../selinux/virt.if:946: Error: duplicate definition of virt_manage_default_image_type(). Original definition on 829. ../selinux/virt.if:986: Error: duplicate definition of virt_systemctl(). Original definition on 851. ../selinux/virt.if:1010: Error: duplicate definition of virt_ptrace(). Original definition on 875. ../selinux/virt.if:1028: Error: duplicate definition of virt_exec_sandbox_files(). Original definition on 893. ../selinux/virt.if:1047: Error: duplicate definition of virt_sandbox_entrypoint(). Original definition on 912. ../selinux/virt.if:1064: Error: duplicate definition of virt_list_sandbox_dirs(). Original definition on 929. ../selinux/virt.if:1082: Error: duplicate definition of virt_read_sandbox_files(). Original definition on 947. ../selinux/virt.if:1102: Error: duplicate definition of virt_manage_sandbox_files(). Original definition on 967. ../selinux/virt.if:1125: Error: duplicate definition of virt_getattr_sandbox_filesystem(). Original definition on 990. ../selinux/virt.if:1143: Error: duplicate definition of virt_relabel_sandbox_filesystem(). Original definition on 1008. ../selinux/virt.if:1161: Error: duplicate definition of virt_mounton_sandbox_file(). Original definition on 1026. ../selinux/virt.if:1179: Error: duplicate definition of virt_stream_connect_sandbox(). Original definition on 1044. ../selinux/virt.if:1207: Error: duplicate definition of virt_transition_svirt(). Original definition on 1072. ../selinux/virt.if:1241: Error: duplicate definition of virt_dontaudit_write_pipes(). Original definition on 1106. ../selinux/virt.if:1260: Error: duplicate definition of virt_kill_svirt(). Original definition on 1125. ../selinux/virt.if:1278: Error: duplicate definition of virt_kill(). Original definition on 1143. ../selinux/virt.if:1298: Error: duplicate definition of virt_signal(). Original definition on 1161. ../selinux/virt.if:1318: Error: duplicate definition of virt_signull(). Original definition on 1179. ../selinux/virt.if:1338: Error: duplicate definition of virt_signal_svirt(). Original definition on 1197. ../selinux/virt.if:1356: Error: duplicate definition of virt_signal_sandbox(). Original definition on 1215. ../selinux/virt.if:1374: Error: duplicate definition of virt_manage_home_files(). Original definition on 1233. ../selinux/virt.if:1394: Error: duplicate definition of virt_read_tmpfs_files(). Original definition on 1253. ../selinux/virt.if:1413: Error: duplicate definition of virt_manage_tmpfs_files(). Original definition on 1272. ../selinux/virt.if:1432: Error: duplicate definition of virt_filetrans_home_content(). Original definition on 1291. ../selinux/virt.if:1462: Error: duplicate definition of virt_dontaudit_read_chr_dev(). Original definition on 1321. ../selinux/virt.if:1518: Error: duplicate definition of virt_sandbox_domain_template(). Original definition on 1340. ../selinux/virt.if:1550: Error: duplicate definition of virt_sandbox_domain(). Original definition on 1372. ../selinux/virt.if:1568: Error: duplicate definition of virt_sandbox_net_domain(). Original definition on 1390. ../selinux/virt.if:1605: Error: duplicate definition of virt_exec_qemu(). Original definition on 1409. ../selinux/virt.if:1623: Error: duplicate definition of virt_filetrans_named_content(). Original definition on 1427. ../selinux/virt.if:1651: Error: duplicate definition of virt_transition_svirt_sandbox(). Original definition on 1455. ../selinux/virt.if:1676: Error: duplicate definition of virt_sandbox_read_state(). Original definition on 1480. ../selinux/virt.if:1694: Error: duplicate definition of virt_rw_svirt_dev(). Original definition on 1498. ../selinux/virt.if:1712: Error: duplicate definition of virt_rw_svirt_image(). Original definition on 1516. ../selinux/virt.if:1730: Error: duplicate definition of virt_rlimitinh(). Original definition on 1534. ../selinux/virt.if:1748: Error: duplicate definition of virt_noatsecure(). Original definition on 1552. ../selinux/virt.if:1773: Error: duplicate definition of virt_admin(). Original definition on 1577. ../selinux/virt.if:1820: Error: duplicate definition of virt_default_capabilities(). Original definition on 1622. ../selinux/virt.if:1839: Error: duplicate definition of virt_dbus_chat(). Original definition on 1642. ../selinux/virt.if:1879: Error: duplicate definition of virt_sandbox_domtrans(). Original definition on 1678. ../selinux/virt.if:1897: Error: duplicate definition of virt_dontaudit_read_state(). Original definition on 1696. ../selinux/virt.if:1917: Error: duplicate definition of virt_dgram_send(). Original definition on 1716. ../selinux/virt.if:1956: Error: duplicate definition of virt_svirt_manage_tmp(). Original definition on 1735.

Regards, Daniel