1 |
commit: 4c30d6c3518839622475b09cd70011ad9bb6f757 |
2 |
Author: Kenton Groombridge <me <AT> concord <DOT> sh> |
3 |
AuthorDate: Mon Jan 24 22:34:27 2022 +0000 |
4 |
Commit: Jason Zaman <perfinion <AT> gentoo <DOT> org> |
5 |
CommitDate: Sun Jan 30 01:15:06 2022 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/hardened-refpolicy.git/commit/?id=4c30d6c3 |
7 |
|
8 |
docker: make rootlesskit optional |
9 |
|
10 |
Avoid a potential build error and circular dependency by making |
11 |
rootlesskit optional. Note that rootlesskit is still required in order |
12 |
for rootless docker to function. |
13 |
|
14 |
Signed-off-by: Kenton Groombridge <me <AT> concord.sh> |
15 |
Signed-off-by: Jason Zaman <perfinion <AT> gentoo.org> |
16 |
|
17 |
policy/modules/services/docker.if | 10 +++++++--- |
18 |
policy/modules/services/docker.te | 6 ++++-- |
19 |
2 files changed, 11 insertions(+), 5 deletions(-) |
20 |
|
21 |
diff --git a/policy/modules/services/docker.if b/policy/modules/services/docker.if |
22 |
index c3ac8174..532fa441 100644 |
23 |
--- a/policy/modules/services/docker.if |
24 |
+++ b/policy/modules/services/docker.if |
25 |
@@ -178,8 +178,6 @@ template(`docker_user_role',` |
26 |
docker_run_user_daemon($3, $4) |
27 |
docker_run_user_cli($3, $4) |
28 |
|
29 |
- rootlesskit_role($1, $2, $3, $4) |
30 |
- |
31 |
ifdef(`init_systemd',` |
32 |
systemd_user_daemon_domain($1, dockerd_exec_t, dockerd_user_t) |
33 |
systemd_user_send_systemd_notify($1, dockerd_user_t) |
34 |
@@ -188,6 +186,10 @@ template(`docker_user_role',` |
35 |
optional_policy(` |
36 |
dbus_spec_session_bus_client($1, dockerd_user_t) |
37 |
') |
38 |
+ |
39 |
+ optional_policy(` |
40 |
+ rootlesskit_role($1, $2, $3, $4) |
41 |
+ ') |
42 |
') |
43 |
|
44 |
######################################## |
45 |
@@ -229,5 +231,7 @@ interface(`docker_signal_user_daemon',` |
46 |
interface(`docker_admin',` |
47 |
docker_run_cli($1, $2) |
48 |
|
49 |
- rootlesskit_run($1, $2) |
50 |
+ optional_policy(` |
51 |
+ rootlesskit_run($1, $2) |
52 |
+ ') |
53 |
') |
54 |
|
55 |
diff --git a/policy/modules/services/docker.te b/policy/modules/services/docker.te |
56 |
index 0e2e2e68..bb5eeb49 100644 |
57 |
--- a/policy/modules/services/docker.te |
58 |
+++ b/policy/modules/services/docker.te |
59 |
@@ -125,8 +125,6 @@ mount_exec(dockerd_user_t) |
60 |
container_setattr_container_ptys(dockerd_user_t) |
61 |
container_use_container_ptys(dockerd_user_t) |
62 |
|
63 |
-rootlesskit_exec(dockerd_user_t) |
64 |
- |
65 |
ifdef(`init_systemd',` |
66 |
systemd_search_user_runtime(dockerd_user_t) |
67 |
systemd_write_user_runtime_socket(dockerd_user_t) |
68 |
@@ -140,6 +138,10 @@ optional_policy(` |
69 |
dbus_write_session_runtime_socket(dockerd_user_t) |
70 |
') |
71 |
|
72 |
+optional_policy(` |
73 |
+ rootlesskit_exec(dockerd_user_t) |
74 |
+') |
75 |
+ |
76 |
######################################## |
77 |
# |
78 |
# Rootless Docker CLI local policy |