Skip to content

Commit

Permalink
MULTIARCH-4654: Enabled the Security Profiles Operator for ppc64le, a…
Browse files Browse the repository at this point in the history 
…dded fixes for seccomp and SELinux profiles, and verified functionality with logenricher.
  • Loading branch information
@pranitaT
pranitaT committed Dec 4, 2024
1 parent 15535de commit 57bc010
Show file tree
Hide file tree
Showing 18 changed files with 1,283 additions and 15 deletions.
6 changes: 4 additions & 2 deletions Dockerfile.ubi
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,8 @@ USER root
WORKDIR /work

RUN dnf install -y \
libseccomp-devel
libseccomp-devel \
libbpf

ADD . /work
RUN mkdir -p build
Expand All @@ -42,7 +43,8 @@ ARG version
USER root

RUN microdnf install -y \
libseccomp
libseccomp\
libbpf

LABEL name="Security Profiles Operator" \
version=$version \
Expand Down
168 changes: 168 additions & 0 deletions bundle/manifests/security-profiles-operator-profile_v1_configmap_ppc64le.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,168 @@
apiVersion: v1
data:
security-profiles-operator.json: |
{
"defaultAction": "SCMP_ACT_LOG",
"architectures": [
"SCMP_ARCH_PPC64LE"
],
"syscalls": [
{
"names": [
"accept4",
"access",
"arch_prctl",
"bind",
"brk",
"bpf",
"capget",
"capset",
"chdir",
"clock_gettime",
"clone",
"clone3",
"close",
"connect",
"epoll_create1",
"epoll_ctl",
"epoll_pwait",
"epoll_wait",
"execve",
"exit",
"exit_group",
"fchown",
"fcntl",
"flock",
"fstat",
"fstatfs",
"fsync",
"futex",
"getcwd",
"getdents64",
"getgid",
"getpeername",
"getpgrp",
"getpid",
"getppid",
"getrandom",
"getrlimit",
"getsockname",
"getsockopt",
"gettid",
"getuid",
"inotify_add_watch",
"inotify_init1",
"listen",
"lseek",
"madvise",
"membarrier",
"mkdirat",
"mlock",
"mmap",
"mprotect",
"munmap",
"nanosleep",
"newfstatat",
"open",
"openat",
"pipe2",
"prctl",
"pread64",
"prlimit64",
"read",
"readlink",
"readlinkat",
"renameat",
"rseq",
"rt_sigaction",
"rt_sigprocmask",
"rt_sigreturn",
"sched_getaffinity",
"sched_yield",
"set_robust_list",
"set_tid_address",
"setgid",
"setgroups",
"setsockopt",
"setuid",
"sigaltstack",
"socket",
"tgkill",
"time",
"uname",
"unlinkat",
"write"
],
"action": "SCMP_ACT_ALLOW"
}
]
}
selinuxd-image-mapping.json: |
[
{
"regex":"(.*)(CoreOS).*([\\d+])\\.8[\\d+]\\.(.*)",
"imageFromVar":"RELATED_IMAGE_SELINUXD_EL8"
},
{
"regex":"(.*)(CoreOS).*([\\d+])\\.9[\\d+]\\.(.*)",
"imageFromVar":"RELATED_IMAGE_SELINUXD_EL9"
},
{
"regex":"Fedora \\d+",
"imageFromVar":"RELATED_IMAGE_SELINUXD_FEDORA"
}
]
selinuxd.cil: |
(block selinuxd
(blockinherit container)
(allow process process ( capability ( dac_override dac_read_search lease audit_write audit_control )))
(allow process default_context_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process default_context_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process default_context_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process default_context_t ( sock_file ( append getattr open read write )))
(allow process etc_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write watch )))
(allow process etc_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process etc_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process etc_t ( sock_file ( append getattr open read write )))
(allow process file_context_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process file_context_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process file_context_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process file_context_t ( sock_file ( append getattr open read write )))
(allow process security_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process security_t ( security ( load_policy )))
(allow process selinux_config_t ( dir ( add_name create getattr ioctl lock open read remove_name rename rmdir search setattr write )))
(allow process selinux_config_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process selinux_config_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process selinux_config_t ( sock_file ( append getattr open read write )))
(allow process selinux_login_config_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process selinux_login_config_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process selinux_login_config_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process selinux_login_config_t ( sock_file ( append getattr open read write )))
(allow process semanage_read_lock_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process semanage_read_lock_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process semanage_read_lock_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process semanage_read_lock_t ( sock_file ( append getattr open read write )))
(allow process semanage_store_t ( dir ( add_name create getattr ioctl lock open read rename remove_name rmdir search setattr write )))
(allow process semanage_store_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process semanage_store_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process semanage_store_t ( sock_file ( append getattr open read write )))
(allow process semanage_trans_lock_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process semanage_trans_lock_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process semanage_trans_lock_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process semanage_trans_lock_t ( sock_file ( append getattr open read write )))
(allow process sysfs_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process sysfs_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process sysfs_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process sysfs_t ( sock_file ( append getattr open read write )))
)
selinuxrecording.cil: |
(block selinuxrecording
(blockinherit container)
(typepermissive process)
)
kind: ConfigMap
metadata:
labels:
app: security-profiles-operator
name: security-profiles-operator-profile
Loading

0 comments on commit 57bc010

Please sign in to comment.