search

containers / udica

This repository contains a tool for generating SELinux security profiles for containers
GNU General Public License v3.0
479 stars 47 forks source link

created policy blocks access to /dev/null #28

Closed laolux closed 5 years ago

laolux commented 5 years ago

Describe the bug Custom policy created with udica blocks access to /dev/null

To Reproduce Steps to reproduce the behavior:

  1. create container with podman, create json file with podman inspect, feed json file to udica
  2. create policy with udica, install with module with semodule -i ...
  3. start container with additional parameter --security-opt label=type:POLICYNAME.process

Expected behavior Container works as before, only a bit more protected in case of unusual behavior.

Additional context Container does not start. Running podman start -i -a container returns Couldn't open /dev/null: Permission denied Running the container without --security-opt ... works without problem, thus I suspect that the generated policy is a bit too strict.