Skip to content

Add new module for incus (container and VM manager) #951

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pebenito merged 13 commits into from
Jul 10, 2025
Merged

Add new module for incus (container and VM manager) #951

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
41a0005
modules: add new incus service module
mschiff Jun 24, 2025
20ef155
iptables: let nft dev_read_urand
mschiff Jun 24, 2025
aaf3c4c
iptables: allow incus_stream_connect_daemon
mschiff Jun 24, 2025
e3d7142
container: add incus/lxc specific file contexts
mschiff Jun 24, 2025
759fceb
container: add new container_init_t local policy
mschiff Jun 24, 2025
a018bfb
qemu: add qemu_incus_managed tunable
mschiff Jun 24, 2025
d243e5e
sysadm: allow incus_stream_connect_daemon
mschiff Jun 24, 2025
37a6f77
dnsmasq: allow to be run by incus
mschiff Jun 24, 2025
e5699b3
dnsmasq: make dnsmasq work with systemd-resolved
mschiff Jun 24, 2025
47877f9
zfs: allow connect to incus daemon
mschiff Jun 24, 2025
a2e74b2
modules: only whitespace fixes spotted while editing modules
mschiff Jun 24, 2025
2d37ac4
kernel: use mmap_read_files_pattern instead of read_files_pattern+allow
mschiff Jun 24, 2025
8468596
kernel: fix for two minor typos
mschiff Jun 24, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions policy/modules/apps/qemu.te
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,14 @@ policy_module(qemu)
## </desc>
gen_tunable(qemu_full_network, false)

## <desc>
## <p>
## Determine whether qemu can be
## managed by incus.
## </p>
## </desc>
gen_tunable(qemu_incus_managed, false)

attribute_role qemu_roles;
roleattribute system_r qemu_roles;

Expand Down Expand Up @@ -47,6 +55,35 @@ tunable_policy(`qemu_full_network',`
corenet_tcp_connect_all_ports(qemu_t)
')

optional_policy(`
tunable_policy(`qemu_incus_managed',`
incus_stream_connect_daemon(qemu_t)

files_create_generic_tmp_named_sockets(qemu_t)

kernel_read_kernel_sysctls(qemu_t)
kernel_read_vm_overcommit_sysctl(qemu_t)

# incus VMs do not start otherwise
allow qemu_t self:capability { dac_override dac_read_search setuid setgid };
allow qemu_t qemu_tmpfs_t:file mmap_read_file_perms;

# this is due to incus lack of selinux support for VMs
# see https://github.com/lxc/incus/issues/1037
kernel_rw_unlabeled_files(qemu_t)
kernel_rw_unlabeled_dirs(qemu_t)
kernel_manage_unlabeled_symlinks(qemu_t)

container_manage_engine_tmp_files(qemu_t)
container_manage_log_files(qemu_t)
container_manage_runtime_files(qemu_t)
container_manage_runtime_sock_files(qemu_t)
')

storage_raw_read_fixed_disk_cond(qemu_t, qemu_incus_managed)
storage_raw_write_fixed_disk_cond(qemu_t, qemu_incus_managed)
')

optional_policy(`
fs_manage_xenfs_files(qemu_t)

Expand Down
29 changes: 24 additions & 5 deletions policy/modules/kernel/devices.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,6 +144,25 @@ interface(`dev_remount_fs',`
allow $1 device_t:filesystem remount;
')

########################################
## <summary>
## Allow to watch filesystem and to
## watch and watch_sb dir.
## </summary>
## <param name="domain">
## <summary>
## Domain to allow
## </summary>
## </param>
interface(`dev_watch_dev_fs',`
gen_require(`
type device_t;
')

allow $1 device_t:filesystem watch;
allow $1 device_t:dir { watch watch_sb };
')

########################################
## <summary>
## Watch the directories in /dev.
Expand Down Expand Up @@ -4969,7 +4988,7 @@ interface(`dev_relabel_all_sysfs',`
#
interface(`dev_setattr_all_sysfs',`
gen_require(`
attribute sysfs_types;
attribute sysfs_types;
')

allow $1 sysfs_types:dir { search_dir_perms setattr };
Expand Down Expand Up @@ -5007,11 +5026,11 @@ interface(`dev_rw_tpm',`
## </param>
#
interface(`dev_rw_uhid',`
gen_require(`
type device_t, uhid_device_t;
')
gen_require(`
type device_t, uhid_device_t;
')

rw_chr_files_pattern($1, device_t, uhid_device_t)
rw_chr_files_pattern($1, device_t, uhid_device_t)
')

########################################
Expand Down
58 changes: 47 additions & 11 deletions policy/modules/kernel/files.if
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -452,6 +452,25 @@ interface(`files_dontaudit_getattr_all_tmpfs_files',`
dontaudit $1 tmpfsfile:file getattr;
')

########################################
## <summary>
## Do not audit attempts to unlink
## sockets in tmp_t directories
## </summary>
## <param name="domain">
## <summary>
## Domain to not audit.
## </summary>
## </param>
#
interface(`files_dontaudit_delete_generic_tmp_named_sockets',`
gen_require(`
type tmp_t;
')

dontaudit $1 tmp_t:sock_file unlink;
')

########################################
## <summary>
## Get the attributes of all directories.
Expand Down Expand Up @@ -4614,8 +4633,7 @@ interface(`files_mmap_read_kernel_modules',`
')

allow $1 modules_object_t:dir list_dir_perms;
read_files_pattern($1, modules_object_t, modules_object_t)
allow $1 modules_object_t:file map;
mmap_read_files_pattern($1, modules_object_t, modules_object_t)
read_lnk_files_pattern($1, modules_object_t, modules_object_t)
')

Expand Down Expand Up @@ -7173,7 +7191,7 @@ interface(`files_exec_runtime',`

########################################
## <summary>
## Dontaudit attempt to execute generic programs in /var/run in the caller domain.
## Dontaudit attempts to execute generic programs in /var/run in the caller domain.
## </summary>
## <param name="domain">
## <summary>
Expand Down Expand Up @@ -7515,6 +7533,24 @@ interface(`files_create_all_runtime_pipes',`

')

########################################
## <summary>
## Create tmp_t sockets.
## </summary>
## <param name="domain">
## <summary>
## Domain allowed access.
## </summary>
## </param>
#
interface(`files_create_generic_tmp_named_sockets',`
gen_require(`
type tmp_t;
')

create_sock_files_pattern($1, tmp_t, tmp_t)
')

########################################
## <summary>
## Delete all runtime named pipes
Expand Down Expand Up @@ -7684,11 +7720,11 @@ interface(`files_runtime_filetrans_lock_dir',`
## </param>
#
interface(`files_create_all_spool_sockets',`
gen_require(`
attribute spoolfile;
')
gen_require(`
attribute spoolfile;
')

allow $1 spoolfile:sock_file create_sock_file_perms;
allow $1 spoolfile:sock_file create_sock_file_perms;
')

########################################
Expand All @@ -7702,11 +7738,11 @@ interface(`files_create_all_spool_sockets',`
## </param>
#
interface(`files_delete_all_spool_sockets',`
gen_require(`
attribute spoolfile;
')
gen_require(`
attribute spoolfile;
')

allow $1 spoolfile:sock_file delete_sock_file_perms;
allow $1 spoolfile:sock_file delete_sock_file_perms;
')

########################################
Expand Down
Loading
Loading