Skip to content

Commit

Permalink
Merge pull request #27 from rhatdan/hirte
Browse files Browse the repository at this point in the history 
Allow qm containers to connect and listen on network
  • Loading branch information
@rhatdan
rhatdan authored May 5, 2023
2 parents a56748f + ae6f6bb commit b6568e7
Showing 1 changed file with 19 additions and 3 deletions.
22 changes: 19 additions & 3 deletions qm.if
View file
Original file line number Diff line number Diff line change
Expand Up @@ -279,9 +279,12 @@ template(`qm_domain_template',`
attribute $1_container_domain;
allow $1_container_domain $1_t:fifo_file rw_inherited_fifo_file_perms;

allow $1_t $1_container_domain:process transition;
allow $1_t $1_container_domain:process all_process_perms;
allow $1_t $1_container_domain:key manage_key_perms;

read_files_pattern($1_t, $1_container_domain,$1_container_domain)
read_lnk_files_pattern($1_t, $1_container_domain,$1_container_domain)

type $1_container_t, $1_container_domain;
domain_type($1_container_t)
domain_user_exemption_target($1_container_t)
Expand Down Expand Up @@ -403,11 +406,11 @@ template(`qm_domain_template',`
allow $1_container_domain self:packet_socket create_socket_perms;
allow $1_container_domain self:passwd rootok;
allow $1_container_domain self:peer recv;
allow $1_container_domain self:process { execmem execstack fork getattr getcap getpgid getsched getsession setcap setpgid setrlimit setsched sigchld sigkill signal signull sigstop setexec setfscreate getrlimit getattr signal_perms getsched getpgid getcap setsched setcap setpgid setrlimit };
allow $1_container_domain self:process all_process_perms;
allow $1_container_domain self:sem create_sem_perms;
allow $1_container_domain self:shm create_shm_perms;
allow $1_container_domain self:socket_class_set { create_socket_perms map accept };
allow $1_container_domain self:tcp_socket create_socket_perms;
allow $1_container_domain self:tcp_socket create_stream_socket_perms;
allow $1_container_domain self:tun_socket { create_socket_perms relabelfrom relabelto attach_queue };
allow $1_container_domain self:udp_socket create_socket_perms;
allow $1_container_domain self:unix_dgram_socket { sendto create_socket_perms };
Expand Down Expand Up @@ -449,6 +452,19 @@ template(`qm_domain_template',`
dontaudit $1_container_domain usermodehelper_t:file write;
dontaudit $1_t $1_container_domain:process { noatsecure rlimitinh siginh };

corenet_icmp_bind_generic_node($1_container_domain)
corenet_raw_bind_generic_node($1_container_domain)
corenet_rw_tun_tap_dev($1_container_domain)
corenet_sctp_bind_all_ports($1_container_domain)
corenet_sctp_connect_all_ports($1_container_domain)
corenet_tcp_bind_all_ports($1_container_domain)
corenet_tcp_bind_generic_node($1_container_domain)
corenet_tcp_connect_all_ports($1_container_domain)
corenet_tcp_sendrecv_all_ports($1_container_domain)
corenet_udp_bind_all_ports($1_container_domain)
corenet_udp_bind_generic_node($1_container_domain)
corenet_udp_sendrecv_all_ports($1_container_domain)

files_read_kernel_modules($1_container_domain)

fs_dontaudit_getattr_all_dirs($1_container_domain)
Expand Down

3 comments on commit b6568e7

@packit-as-a-service
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on your Packit configuration the settings of the rhcontainerbot/qm Copr project would need to be updated as follows:

field old value new value
chroots ['fedora-38-aarch64', 'centos-stream-9-x86_64', 'fedora-38-ppc64le', 'centos-stream-9-aarch64', 'fedora-38-x86_64', 'centos-stream-9-ppc64le'] ['centos-stream-9-aarch64', 'centos-stream-9-ppc64le', 'centos-stream-9-s390x', 'centos-stream-9-x86_64', 'fedora-38-aarch64', 'fedora-38-ppc64le', 'fedora-38-x86_64']

Diff of chroots:

+centos-stream-9-s390x

Packit was unable to update the settings above as it is missing admin permissions on the rhcontainerbot/qm Copr project.

To fix this you can do one of the following:

  • Grant Packit admin permissions on the rhcontainerbot/qm Copr project on the permissions page.
  • Change the above Copr project settings manually on the settings page to match the Packit configuration.
  • Update the Packit configuration to match the Copr project settings.

Please retrigger the build, once the issue above is fixed.

@packit-as-a-service
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on your Packit configuration the settings of the rhcontainerbot/qm Copr project would need to be updated as follows:

field old value new value
chroots ['fedora-38-aarch64', 'centos-stream-9-x86_64', 'fedora-38-ppc64le', 'centos-stream-9-aarch64', 'fedora-38-x86_64', 'centos-stream-9-ppc64le'] ['centos-stream-9-aarch64', 'centos-stream-9-ppc64le', 'centos-stream-9-s390x', 'centos-stream-9-x86_64', 'fedora-38-aarch64', 'fedora-38-ppc64le', 'fedora-38-x86_64']

Diff of chroots:

+centos-stream-9-s390x

Packit was unable to update the settings above as it is missing admin permissions on the rhcontainerbot/qm Copr project.

To fix this you can do one of the following:

  • Grant Packit admin permissions on the rhcontainerbot/qm Copr project on the permissions page.
  • Change the above Copr project settings manually on the settings page to match the Packit configuration.
  • Update the Packit configuration to match the Copr project settings.

Please retrigger the build, once the issue above is fixed.

@packit-as-a-service
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Based on your Packit configuration the settings of the rhcontainerbot/qm Copr project would need to be updated as follows:

field old value new value
chroots ['fedora-38-aarch64', 'fedora-38-ppc64le', 'fedora-38-x86_64', 'centos-stream-9-aarch64', 'centos-stream-9-ppc64le', 'centos-stream-9-x86_64'] ['centos-stream-9-aarch64', 'centos-stream-9-ppc64le', 'centos-stream-9-s390x', 'centos-stream-9-x86_64', 'fedora-38-aarch64', 'fedora-38-ppc64le', 'fedora-38-x86_64']

Diff of chroots:

+centos-stream-9-s390x

Packit was unable to update the settings above as it is missing admin permissions on the rhcontainerbot/qm Copr project.

To fix this you can do one of the following:

  • Grant Packit admin permissions on the rhcontainerbot/qm Copr project on the permissions page.
  • Change the above Copr project settings manually on the settings page to match the Packit configuration.
  • Update the Packit configuration to match the Copr project settings.

Please retrigger the build, once the issue above is fixed.

Please sign in to comment.