[PATCH v2] Add SELinux policy for virt

[Vit Mojzis]

On 4/26/21 7:03 PM, Daniel P. Berrangé wrote:
> On Wed, Apr 07, 2021 at 06:14:58AM -0700, Vit Mojzis wrote:
>> Sorry for the long delay. This is our first request to ship a policy for
>> multiple selinux stores (targeted, mls and minimum).
>>
>> Changes:
>> * Replace all selinux-policy-%{policytype} dependencies with selinux-policy-base
>> * Add Ghost files representing installed policy modules in all policy stores
>> * Rewrite policy compilation script in python
>> * Compile the policy module twice (1 version for targeted/minimum - with
>>    enable_mcs, and 1 for mls - with enable_mls)
>> * Manage policy (un)installation using triggers based on which policy
>>    type is available
>>
>> The new policy was only tested in "targeted" mode so far and we'll need to make
>> sure it works properly in "mls". As for "minimum", we know it will not
>> work properly (as is the case of the current policy) by default (some
>> other "contrib" policy modules need to be enabled).
>> I'd argue there is no point trying to get it to work in "minimum",
>> mostly because it (minimum) will be retired soon.
> Running a build with this seris causes a tonne of warning messages
> on the console:
>
> [1310/1319] Generating virt.pp with a custom command
> /usr/share/selinux/devel/include/services/container.if:13: Error: duplicate definition of container_runtime_domtrans(). Original definition on 13.
> /usr/share/selinux/devel/include/services/container.if:40: Error: duplicate definition of container_runtime_run(). Original definition on 40.
> /usr/share/selinux/devel/include/services/container.if:61: Error: duplicate definition of container_runtime_exec(). Original definition on 61.
> /usr/share/selinux/devel/include/services/container.if:80: Error: duplicate definition of container_read_state(). Original definition on 80.
> /usr/share/selinux/devel/include/services/container.if:98: Error: duplicate definition of container_search_lib(). Original definition on 98.
> /usr/share/selinux/devel/include/services/container.if:117: Error: duplicate definition of container_exec_lib(). Original definition on 117.
> /usr/share/selinux/devel/include/services/container.if:136: Error: duplicate definition of container_read_lib_files(). Original definition on 136.
> /usr/share/selinux/devel/include/services/container.if:155: Error: duplicate definition of container_read_share_files(). Original definition on 155.
> /usr/share/selinux/devel/include/services/container.if:176: Error: duplicate definition of container_runtime_read_tmpfs_files(). Original definition on 176.
> /usr/share/selinux/devel/include/services/container.if:197: Error: duplicate definition of container_manage_share_files(). Original definition on 197.
> /usr/share/selinux/devel/include/services/container.if:218: Error: duplicate definition of container_manage_share_dirs(). Original definition on 218.
> /usr/share/selinux/devel/include/services/container.if:238: Error: duplicate definition of container_exec_share_files(). Original definition on 238.
> /usr/share/selinux/devel/include/services/container.if:256: Error: duplicate definition of container_manage_config_files(). Original definition on 256.
> /usr/share/selinux/devel/include/services/container.if:275: Error: duplicate definition of container_manage_lib_files(). Original definition on 275.
> /usr/share/selinux/devel/include/services/container.if:295: Error: duplicate definition of container_manage_files(). Original definition on 295.
> /usr/share/selinux/devel/include/services/container.if:314: Error: duplicate definition of container_manage_dirs(). Original definition on 314.
> /usr/share/selinux/devel/include/services/container.if:332: Error: duplicate definition of container_manage_lib_dirs(). Original definition on 332.
> /usr/share/selinux/devel/include/services/container.if:368: Error: duplicate definition of container_lib_filetrans(). Original definition on 368.
> /usr/share/selinux/devel/include/services/container.if:386: Error: duplicate definition of container_read_pid_files(). Original definition on 386.
> /usr/share/selinux/devel/include/services/container.if:405: Error: duplicate definition of container_systemctl(). Original definition on 405.
> /usr/share/selinux/devel/include/services/container.if:430: Error: duplicate definition of container_rw_sem(). Original definition on 430.
> /usr/share/selinux/devel/include/services/container.if:449: Error: duplicate definition of container_append_file(). Original definition on 449.
> /usr/share/selinux/devel/include/services/container.if:467: Error: duplicate definition of container_use_ptys(). Original definition on 467.
> /usr/share/selinux/devel/include/services/container.if:485: Error: duplicate definition of container_filetrans_named_content(). Original definition on 485.
> /usr/share/selinux/devel/include/services/container.if:549: Error: duplicate definition of container_stream_connect(). Original definition on 549.
> /usr/share/selinux/devel/include/services/container.if:570: Error: duplicate definition of container_spc_stream_connect(). Original definition on 570.
> /usr/share/selinux/devel/include/services/container.if:591: Error: duplicate definition of container_admin(). Original definition on 591.
> /usr/share/selinux/devel/include/services/container.if:638: Error: duplicate definition of container_auth_domtrans(). Original definition on 638.
> /usr/share/selinux/devel/include/services/container.if:657: Error: duplicate definition of container_auth_exec(). Original definition on 657.
> /usr/share/selinux/devel/include/services/container.if:676: Error: duplicate definition of container_auth_stream_connect(). Original definition on 676.
> /usr/share/selinux/devel/include/services/container.if:695: Error: duplicate definition of container_runtime_typebounds(). Original definition on 695.
> /usr/share/selinux/devel/include/services/container.if:714: Error: duplicate definition of container_runtime_entrypoint(). Original definition on 714.
> /usr/share/selinux/devel/include/services/container.if:721: Error: duplicate definition of docker_exec_lib(). Original definition on 721.
> /usr/share/selinux/devel/include/services/container.if:725: Error: duplicate definition of docker_read_share_files(). Original definition on 725.
> /usr/share/selinux/devel/include/services/container.if:729: Error: duplicate definition of docker_exec_share_files(). Original definition on 729.
> /usr/share/selinux/devel/include/services/container.if:733: Error: duplicate definition of docker_manage_lib_files(). Original definition on 733.
> /usr/share/selinux/devel/include/services/container.if:738: Error: duplicate definition of docker_manage_lib_dirs(). Original definition on 738.
> /usr/share/selinux/devel/include/services/container.if:742: Error: duplicate definition of docker_lib_filetrans(). Original definition on 742.
> /usr/share/selinux/devel/include/services/container.if:746: Error: duplicate definition of docker_read_pid_files(). Original definition on 746.
> /usr/share/selinux/devel/include/services/container.if:750: Error: duplicate definition of docker_systemctl(). Original definition on 750.
> /usr/share/selinux/devel/include/services/container.if:754: Error: duplicate definition of docker_use_ptys(). Original definition on 754.
> /usr/share/selinux/devel/include/services/container.if:758: Error: duplicate definition of docker_stream_connect(). Original definition on 758.
> /usr/share/selinux/devel/include/services/container.if:762: Error: duplicate definition of docker_spc_stream_connect(). Original definition on 762.
> /usr/share/selinux/devel/include/services/container.if:776: Error: duplicate definition of container_spc_read_state(). Original definition on 776.
> /usr/share/selinux/devel/include/services/container.if:795: Error: duplicate definition of container_runtime_domain_template(). Original definition on 795.
> /usr/share/selinux/devel/include/services/container.if:833: Error: duplicate definition of container_domain_template(). Original definition on 833.
> /usr/share/selinux/devel/include/services/container.if:861: Error: duplicate definition of container_spc_rw_pipes(). Original definition on 861.
> ../selinux/virt.if:13: Error: duplicate definition of virt_stub_lxc(). Original definition on 13.
> ../selinux/virt.if:29: Error: duplicate definition of virt_stub_svirt_sandbox_domain(). Original definition on 29.
> ../selinux/virt.if:45: Error: duplicate definition of virt_stub_container_image(). Original definition on 45.
> ../selinux/virt.if:51: Error: duplicate definition of virt_stub_svirt_sandbox_file(). Original definition on 51.
> ../selinux/virt.if:69: Error: duplicate definition of virt_domain_template(). Original definition on 69.
> ../selinux/virt.if:206: Error: duplicate definition of virt_image(). Original definition on 112.
> ../selinux/virt.if:228: Error: duplicate definition of virt_getattr_exec(). Original definition on 134.
> ../selinux/virt.if:248: Error: duplicate definition of virt_domtrans(). Original definition on 152.
> ../selinux/virt.if:266: Error: duplicate definition of virt_exec(). Original definition on 170.
> ../selinux/virt.if:286: Error: duplicate definition of virt_stream_connect(). Original definition on 205.
> ../selinux/virt.if:328: Error: duplicate definition of virt_stream_connect_svirt(). Original definition on 224.
> ../selinux/virt.if:348: Error: duplicate definition of virt_rw_stream_sockets_svirt(). Original definition on 244.
> ../selinux/virt.if:366: Error: duplicate definition of virt_attach_tun_iface(). Original definition on 262.
> ../selinux/virt.if:387: Error: duplicate definition of virt_attach_sandbox_tun_iface(). Original definition on 281.
> ../selinux/virt.if:406: Error: duplicate definition of virt_read_config(). Original definition on 300.
> ../selinux/virt.if:427: Error: duplicate definition of virt_manage_config(). Original definition on 321.
> ../selinux/virt.if:448: Error: duplicate definition of virt_getattr_content(). Original definition on 342.
> ../selinux/virt.if:466: Error: duplicate definition of virt_read_content(). Original definition on 360.
> ../selinux/virt.if:504: Error: duplicate definition of virt_write_content(). Original definition on 398.
> ../selinux/virt.if:522: Error: duplicate definition of virt_read_pid_symlinks(). Original definition on 416.
> ../selinux/virt.if:543: Error: duplicate definition of virt_read_pid_files(). Original definition on 435.
> ../selinux/virt.if:566: Error: duplicate definition of virt_manage_pid_dirs(). Original definition on 455.
> ../selinux/virt.if:590: Error: duplicate definition of virt_manage_pid_files(). Original definition on 477.
> ../selinux/virt.if:630: Error: duplicate definition of virt_pid_filetrans(). Original definition on 515.
> ../selinux/virt.if:650: Error: duplicate definition of virt_search_lib(). Original definition on 533.
> ../selinux/virt.if:669: Error: duplicate definition of virt_read_lib_files(). Original definition on 552.
> ../selinux/virt.if:690: Error: duplicate definition of virt_dontaudit_read_lib_files(). Original definition on 573.
> ../selinux/virt.if:709: Error: duplicate definition of virt_manage_lib_files(). Original definition on 592.
> ../selinux/virt.if:729: Error: duplicate definition of virt_read_log(). Original definition on 612.
> ../selinux/virt.if:749: Error: duplicate definition of virt_append_log(). Original definition on 632.
> ../selinux/virt.if:768: Error: duplicate definition of virt_manage_log(). Original definition on 651.
> ../selinux/virt.if:788: Error: duplicate definition of virt_getattr_images(). Original definition on 671.
> ../selinux/virt.if:807: Error: duplicate definition of virt_search_images(). Original definition on 690.
> ../selinux/virt.if:826: Error: duplicate definition of virt_read_images(). Original definition on 709.
> ../selinux/virt.if:863: Error: duplicate definition of virt_read_blk_images(). Original definition on 746.
> ../selinux/virt.if:881: Error: duplicate definition of virt_rw_chr_files(). Original definition on 764.
> ../selinux/virt.if:900: Error: duplicate definition of virt_manage_cache(). Original definition on 783.
> ../selinux/virt.if:921: Error: duplicate definition of virt_manage_images(). Original definition on 804.
> ../selinux/virt.if:946: Error: duplicate definition of virt_manage_default_image_type(). Original definition on 829.
> ../selinux/virt.if:986: Error: duplicate definition of virt_systemctl(). Original definition on 851.
> ../selinux/virt.if:1010: Error: duplicate definition of virt_ptrace(). Original definition on 875.
> ../selinux/virt.if:1028: Error: duplicate definition of virt_exec_sandbox_files(). Original definition on 893.
> ../selinux/virt.if:1047: Error: duplicate definition of virt_sandbox_entrypoint(). Original definition on 912.
> ../selinux/virt.if:1064: Error: duplicate definition of virt_list_sandbox_dirs(). Original definition on 929.
> ../selinux/virt.if:1082: Error: duplicate definition of virt_read_sandbox_files(). Original definition on 947.
> ../selinux/virt.if:1102: Error: duplicate definition of virt_manage_sandbox_files(). Original definition on 967.
> ../selinux/virt.if:1125: Error: duplicate definition of virt_getattr_sandbox_filesystem(). Original definition on 990.
> ../selinux/virt.if:1143: Error: duplicate definition of virt_relabel_sandbox_filesystem(). Original definition on 1008.
> ../selinux/virt.if:1161: Error: duplicate definition of virt_mounton_sandbox_file(). Original definition on 1026.
> ../selinux/virt.if:1179: Error: duplicate definition of virt_stream_connect_sandbox(). Original definition on 1044.
> ../selinux/virt.if:1207: Error: duplicate definition of virt_transition_svirt(). Original definition on 1072.
> ../selinux/virt.if:1241: Error: duplicate definition of virt_dontaudit_write_pipes(). Original definition on 1106.
> ../selinux/virt.if:1260: Error: duplicate definition of virt_kill_svirt(). Original definition on 1125.
> ../selinux/virt.if:1278: Error: duplicate definition of virt_kill(). Original definition on 1143.
> ../selinux/virt.if:1298: Error: duplicate definition of virt_signal(). Original definition on 1161.
> ../selinux/virt.if:1318: Error: duplicate definition of virt_signull(). Original definition on 1179.
> ../selinux/virt.if:1338: Error: duplicate definition of virt_signal_svirt(). Original definition on 1197.
> ../selinux/virt.if:1356: Error: duplicate definition of virt_signal_sandbox(). Original definition on 1215.
> ../selinux/virt.if:1374: Error: duplicate definition of virt_manage_home_files(). Original definition on 1233.
> ../selinux/virt.if:1394: Error: duplicate definition of virt_read_tmpfs_files(). Original definition on 1253.
> ../selinux/virt.if:1413: Error: duplicate definition of virt_manage_tmpfs_files(). Original definition on 1272.
> ../selinux/virt.if:1432: Error: duplicate definition of virt_filetrans_home_content(). Original definition on 1291.
> ../selinux/virt.if:1462: Error: duplicate definition of virt_dontaudit_read_chr_dev(). Original definition on 1321.
> ../selinux/virt.if:1518: Error: duplicate definition of virt_sandbox_domain_template(). Original definition on 1340.
> ../selinux/virt.if:1550: Error: duplicate definition of virt_sandbox_domain(). Original definition on 1372.
> ../selinux/virt.if:1568: Error: duplicate definition of virt_sandbox_net_domain(). Original definition on 1390.
> ../selinux/virt.if:1605: Error: duplicate definition of virt_exec_qemu(). Original definition on 1409.
> ../selinux/virt.if:1623: Error: duplicate definition of virt_filetrans_named_content(). Original definition on 1427.
> ../selinux/virt.if:1651: Error: duplicate definition of virt_transition_svirt_sandbox(). Original definition on 1455.
> ../selinux/virt.if:1676: Error: duplicate definition of virt_sandbox_read_state(). Original definition on 1480.
> ../selinux/virt.if:1694: Error: duplicate definition of virt_rw_svirt_dev(). Original definition on 1498.
> ../selinux/virt.if:1712: Error: duplicate definition of virt_rw_svirt_image(). Original definition on 1516.
> ../selinux/virt.if:1730: Error: duplicate definition of virt_rlimitinh(). Original definition on 1534.
> ../selinux/virt.if:1748: Error: duplicate definition of virt_noatsecure(). Original definition on 1552.
> ../selinux/virt.if:1773: Error: duplicate definition of virt_admin(). Original definition on 1577.
> ../selinux/virt.if:1820: Error: duplicate definition of virt_default_capabilities(). Original definition on 1622.
> ../selinux/virt.if:1839: Error: duplicate definition of virt_dbus_chat(). Original definition on 1642.
> ../selinux/virt.if:1879: Error: duplicate definition of virt_sandbox_domtrans(). Original definition on 1678.
> ../selinux/virt.if:1897: Error: duplicate definition of virt_dontaudit_read_state(). Original definition on 1696.
> ../selinux/virt.if:1917: Error: duplicate definition of virt_dgram_send(). Original definition on 1716.
> ../selinux/virt.if:1956: Error: duplicate definition of virt_svirt_manage_tmp(). Original definition on 1735.

Those are expected as long as there is still virt.if interface file 
shipped by selinux-policy-* packages (we'll probably change the tone to 
Warning instead of Error in the future). Unfortunately they add up (you 
can see container-selinux messages as well).

I can hide them in the compilation script if you prefer that.

Regards,

Vit

>
> Regards,
> Daniel