search

containers / udica

This repository contains a tool for generating SELinux security profiles for containers
GNU General Public License v3.0
488 stars 47 forks source link

Initial CRI-O support #40

Closed JAORMX closed 5 years ago

JAORMX commented 5 years ago

This takes modifies udica to also take the "inspect" format that crictl gives out, and not only the docker/podman one.

Note that in this implementation, only the json file works; support for parsing the input from the crictl command will come in a separate PR.

JAORMX commented 5 years ago

Didn't reaaaally test extensively if it still works with podman/docker. So... if someone could help verify that it would be great :smile:

JAORMX commented 5 years ago

@wrabcak could you take a look?

JAORMX commented 5 years ago

the meta task seems broken with an unrelated error.

wrabcak commented 5 years ago

@JAORMX , We need tests for this new feature. Could you please share inspection file from CRI-O engine, where you're mounting /home with read-only perms and /var/spool/ with read/write perms? Something similar to https://github.com/containers/udica/blob/master/tests/test_basic.podman.json and I'll add some tests to upstream testsuite.

I also did manual testing of all features with scratch build where this patch was included, so it looks good. Adding scratch build for testing purposes: https://copr.fedorainfracloud.org/coprs/lvrabec/udica/build/1037989/

Thanks, Lukas.

AkihiroSuda commented 5 years ago

Is this specific to crio? Does it work with containerd as well?

JAORMX commented 5 years ago

@AkihiroSuda I only tested it on CRI-O. But in theory it should work on containerd as well, since they all follow the CRI interface. Would be a matter of testing it out.

wrabcak commented 5 years ago

@AkihiroSuda, would it be possible to test udica also with containerd ?

If it's not working, I could help to incorporate also support for containerd engine.

wrabcak commented 5 years ago

Merging, Thanks!