commit: 79b0ec7e2d66dadd3570e99801632ac32cfe0147
Author: Kenton Groombridge <me <AT> concord <DOT> sh>
AuthorDate: Sat Dec 4 18:43:43 2021 +0000
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org>
CommitDate: Sun Jan 30 01:12:42 2022 +0000
URL:
https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=79b0ec7e
container, iptables: dontaudit iptables rw on /ptmx
Signed-off-by: Kenton Groombridge <me <AT> concord.sh>
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org>
policy/modules/services/container.if | 19 +++++++++++++++++++
policy/modules/system/iptables.te | 5 +++++
2 files changed, 24 insertions(+)
diff --git a/policy/modules/services/container.if
b/policy/modules/services/container.if
index d7ad3e84..92b5a2f7 100644
--- a/policy/modules/services/container.if
+++ b/policy/modules/services/container.if
@@ -611,6 +611,25 @@ interface(`container_manage_sock_files',`
manage_sock_files_pattern($1, container_file_t, container_file_t)
')
+########################################
+## <summary>
+## Do not audit attempts to read
+## and write container chr files.
+## </summary>
+## <param name="domain">
+## <summary>
+## Domain allowed access.
+## </summary>
+## </param>
+#
+interface(`container_dontaudit_rw_chr_files',`
+ gen_require(`
+ type container_file_t;
+ ')
+
+ dontaudit $1 container_file_t:chr_file rw_chr_file_perms;
+')
+
########################################
## <summary>
## Allow the specified domain to
diff --git a/policy/modules/system/iptables.te
b/policy/modules/system/iptables.te
index f61b8af1..39ce924d 100644
--- a/policy/modules/system/iptables.te
+++ b/policy/modules/system/iptables.te
@@ -105,6 +105,11 @@ ifdef(`hide_broken_symptoms',`
dev_dontaudit_write_mtrr(iptables_t)
')
+optional_policy(`
+ # iptables may try to rw /ptmx in a container
+ container_dontaudit_rw_chr_files(iptables_t)
+')
+
optional_policy(`
fail2ban_append_log(iptables_t)
')
