Re: container and staff_t

Kenton Groombridge <[email protected]> Sat, 30 Aug 2025 14:22:24 -0400

Newsgroups	org.kernel.vger.selinux-refpolicy
Message-ID	<x7p6j522rntl7xqdtosjefb2amgjbi3yyzuvqty4mdalye33pq@a5jwkoyyuryh>

On 25/08/29 08:20PM, Russell Coker wrote:
> grep -R container_user_role policy/
> policy/modules/roles/staff.te:	container_user_role(staff, staff_t, 
> staff_application_exec_domain, staff_r)
> policy/modules/services/container.if:template(`container_user_role',`
> 
> Why is staff_t the only domain for container_user_role() ?
> 

When the container policy was originally written, it was only tested
with staff_t and unconfined_t at the time.

The other roles (mostly user_t) should probably also be allowed to use
it but I would personally rather it be a tunable for each given the
amount of attack surface that unprivilged containers can still expose.
If we did that, staff_t should probably be tunable as well.

---
Kenton Groombridge

signature.asc (application/pgp-signature, 963 B)