fix: allow CNI SELinux runtime operations

Allow pod domains to perform CNI/BPF operations currently required by Cilium/Multus-style networking, including BPF filesystem writes, CNI state access, CNI socket connectto, and bounded runtime relabel/read cases. Also allow initramfs/udev startup handoff operations observed during CNI/plugin execution.

Signed-off-by: howdude230 <47754786+howdude230@users.noreply.github.com>

Author: howdude230

internal/pkg/selinux/policy/policy.33

@@ -128,13 +128,14 @@
 
 ; ; cilium-agent
 ; (allow any_p self (perf_event (all)))
-; (allow any_p bpf_t (fs_classes (rw)))
+(allow any_p bpf_t (fs_classes (rw)))
 
 ; fio
 (allow any_p self (shm (all)))
 
 ; /run/flannel, created by containerd
 (allow any_p pod_containerd_run_t (fs_classes (rw)))
+(allow pod_p pod_containerd_run_t (fs_classes (relabelfrom relabelto)))
 
 ; Mayastor
 (allow any_p hugetlbfs_t (fs_classes (rw)))

internal/pkg/selinux/policy/selinux/common/processes.cil

@@ -46,6 +46,7 @@
 (allow pod_containerd_t bin_exec_t (fs_classes (ro)))
 ; (allow pod_p cni_conf_t (fs_classes (rw)))
 (allow pod_containerd_t cni_state_t (fs_classes (rw)))
+(allow pod_p cni_state_t (fs_classes (rw)))
 
 ; Logs
 (allow pod_containerd_t pods_log_t (fs_classes (rw)))
@@ -163,7 +164,7 @@
 (allow pod_p devpts_t (fs_classes (rw)))
 
 ; ; cilium
-; (allow pod_containerd_t pod_p (unix_stream_socket (connectto)))
+(allow pod_containerd_t pod_p (unix_stream_socket (connectto)))
 
 ; pkg/flannel
 (allow pod_p cni_conf_t (fs_classes (rw)))
@@ -211,6 +212,16 @@
 ; `install` also seems to test the plugin
 (allow pod_t cni_plugin_t (file (execute execute_no_trans)))
 
+; CNI agents manage pinned BPF programs/maps owned by containerd processes.
+(allow pod_p pod_containerd_t (bpf (prog_run)))
+(allow pod_p sys_containerd_t (bpf (prog_run)))
+
+; Host diagnostics mounted into pods can expose proc entries labelled with the
+; owning process domain instead of procfs_t.
+(allow pod_p init_t (file (getattr open read)))
+(allow pod_p rootfs_t (filesystem (getattr)))
+(allow pod_p udev_run_t (fs_classes (ro)))
+
 ; TinK is an example of what needs this. Docker in a pod will also require this.
 (allow pod_p cgroup_t (fs_classes (rw)))
 (allow pod_p nsfs_t (fs_classes (ro)))

internal/pkg/selinux/policy/selinux/services/cri.cil

@@ -94,8 +94,13 @@
 (allow kernel_t initramfs_t (fd (use)))
 ; Make machined go into proper context
 (allow initramfs_t bin_exec_t (fs_classes (ro))) ; Find init
+(allow initramfs_t bin_exec_t (file (execute execute_no_trans)))
 (allow initramfs_t init_exec_t (fs_classes (ro)))
 (allow initramfs_t init_exec_t (file (execute)))
+(allow initramfs_t cni_plugin_t (fs_classes (ro)))
+(allow initramfs_t cni_plugin_t (file (execute execute_no_trans)))
+(allow initramfs_t modprobe_exec_t (fs_classes (ro)))
+(allow initramfs_t modprobe_exec_t (file (execute execute_no_trans)))
 (typetransition initramfs_t init_exec_t process init_t)
 (allow initramfs_t init_t (process_classes (full)))
 (allow init_t initramfs_t (fd (use)))

internal/pkg/selinux/policy/selinux/services/machined.cil

@@ -112,3 +112,4 @@
 (allow udev_t bin_exec_t (file (execute execute_no_trans)))
 (allow udev_t kernel_t (system (ipc_info)))
 (allow udev_t any_p (sem (all)))
+(allow udev_t initramfs_t (fd (use)))