mirror of
https://github.com/containers/udica
synced 2024-05-26 02:06:12 +02:00
31bccb3100
Commit adds functionality to generate allow rules when --device switch
is used for podman e.g: podman run --device /dev/tty0 fedora /bin/bash
The output policy should looks like:
(block devtest
(blockinherit container)
(allow process process ( capability ( audit_write chown dac_override fowner fsetid kill mknod net_bind_service net_raw setfcap setgid setpcap setuid sys_chroot )))
(allow process tty_device_t ( blk_file ( getattr read write append ioctl lock open )))
(allow process tty_device_t ( chr_file ( getattr read write append ioctl lock open )))
)
The feature is applicable for podman and docker engines, CRI-O uses
bind-mount solution.
285 lines
9.9 KiB
JSON
285 lines
9.9 KiB
JSON
[
|
|
{
|
|
"Id": "6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b",
|
|
"Created": "2020-11-24T20:06:25.852770272+01:00",
|
|
"Path": "/bin/bash",
|
|
"Args": [
|
|
"/bin/bash"
|
|
],
|
|
"State": {
|
|
"OciVersion": "1.0.2-dev",
|
|
"Status": "running",
|
|
"Running": true,
|
|
"Paused": false,
|
|
"Restarting": false,
|
|
"OOMKilled": false,
|
|
"Dead": false,
|
|
"Pid": 240290,
|
|
"ConmonPid": 240287,
|
|
"ExitCode": 0,
|
|
"Error": "",
|
|
"StartedAt": "2020-11-24T20:06:25.990467073+01:00",
|
|
"FinishedAt": "0001-01-01T00:00:00Z",
|
|
"Healthcheck": {
|
|
"Status": "",
|
|
"FailingStreak": 0,
|
|
"Log": null
|
|
}
|
|
},
|
|
"Image": "79fd58dc76113dac76a120f22cadecc3b2d1794b414f90ea368cf66096700053",
|
|
"ImageName": "registry.fedoraproject.org/fedora:latest",
|
|
"Rootfs": "",
|
|
"Pod": "",
|
|
"ResolvConfPath": "/var/run/containers/storage/overlay-containers/6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b/userdata/resolv.conf",
|
|
"HostnamePath": "/var/run/containers/storage/overlay-containers/6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b/userdata/hostname",
|
|
"HostsPath": "/var/run/containers/storage/overlay-containers/6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b/userdata/hosts",
|
|
"StaticDir": "/var/lib/containers/storage/overlay-containers/6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b/userdata",
|
|
"OCIConfigPath": "/var/lib/containers/storage/overlay-containers/6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b/userdata/config.json",
|
|
"OCIRuntime": "crun",
|
|
"LogPath": "/var/lib/containers/storage/overlay-containers/6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b/userdata/ctr.log",
|
|
"LogTag": "",
|
|
"ConmonPidFile": "/var/run/containers/storage/overlay-containers/6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b/userdata/conmon.pid",
|
|
"Name": "upbeat_ellis",
|
|
"RestartCount": 0,
|
|
"Driver": "overlay",
|
|
"MountLabel": "system_u:object_r:container_file_t:s0:c543,c755",
|
|
"ProcessLabel": "system_u:system_r:container_t:s0:c543,c755",
|
|
"AppArmorProfile": "",
|
|
"EffectiveCaps": [
|
|
"CAP_AUDIT_WRITE",
|
|
"CAP_CHOWN",
|
|
"CAP_DAC_OVERRIDE",
|
|
"CAP_FOWNER",
|
|
"CAP_FSETID",
|
|
"CAP_KILL",
|
|
"CAP_MKNOD",
|
|
"CAP_NET_BIND_SERVICE",
|
|
"CAP_NET_RAW",
|
|
"CAP_SETFCAP",
|
|
"CAP_SETGID",
|
|
"CAP_SETPCAP",
|
|
"CAP_SETUID",
|
|
"CAP_SYS_CHROOT"
|
|
],
|
|
"BoundingCaps": [
|
|
"CAP_AUDIT_WRITE",
|
|
"CAP_CHOWN",
|
|
"CAP_DAC_OVERRIDE",
|
|
"CAP_FOWNER",
|
|
"CAP_FSETID",
|
|
"CAP_KILL",
|
|
"CAP_MKNOD",
|
|
"CAP_NET_BIND_SERVICE",
|
|
"CAP_NET_RAW",
|
|
"CAP_SETFCAP",
|
|
"CAP_SETGID",
|
|
"CAP_SETPCAP",
|
|
"CAP_SETUID",
|
|
"CAP_SYS_CHROOT"
|
|
],
|
|
"ExecIDs": [],
|
|
"GraphDriver": {
|
|
"Name": "overlay",
|
|
"Data": {
|
|
"LowerDir": "/var/lib/containers/storage/overlay/b4fa6ff1346dec95ce4454464201fdadfd816e10eb7322048829c551ce032d08/diff",
|
|
"MergedDir": "/var/lib/containers/storage/overlay/6dea692afd62add0259ae00d5c343806467c305de241df5dee32b500db315249/merged",
|
|
"UpperDir": "/var/lib/containers/storage/overlay/6dea692afd62add0259ae00d5c343806467c305de241df5dee32b500db315249/diff",
|
|
"WorkDir": "/var/lib/containers/storage/overlay/6dea692afd62add0259ae00d5c343806467c305de241df5dee32b500db315249/work"
|
|
}
|
|
},
|
|
"Mounts": [],
|
|
"Dependencies": [],
|
|
"NetworkSettings": {
|
|
"EndpointID": "",
|
|
"Gateway": "10.88.0.1",
|
|
"IPAddress": "10.88.0.19",
|
|
"IPPrefixLen": 16,
|
|
"IPv6Gateway": "",
|
|
"GlobalIPv6Address": "",
|
|
"GlobalIPv6PrefixLen": 0,
|
|
"MacAddress": "06:d8:84:ef:b9:d0",
|
|
"Bridge": "",
|
|
"SandboxID": "",
|
|
"HairpinMode": false,
|
|
"LinkLocalIPv6Address": "",
|
|
"LinkLocalIPv6PrefixLen": 0,
|
|
"Ports": {},
|
|
"SandboxKey": "/var/run/netns/cni-d1e80ea0-dca3-ade7-34b9-34ad49135471"
|
|
},
|
|
"ExitCommand": [
|
|
"/usr/bin/podman",
|
|
"--root",
|
|
"/var/lib/containers/storage",
|
|
"--runroot",
|
|
"/var/run/containers/storage",
|
|
"--log-level",
|
|
"error",
|
|
"--cgroup-manager",
|
|
"systemd",
|
|
"--tmpdir",
|
|
"/var/run/libpod",
|
|
"--runtime",
|
|
"crun",
|
|
"--storage-driver",
|
|
"overlay",
|
|
"--storage-opt",
|
|
"overlay.mountopt=nodev,metacopy=on",
|
|
"--events-backend",
|
|
"journald",
|
|
"container",
|
|
"cleanup",
|
|
"6335b78454e65cecc2c3c78c402e16d1a0691cf416468822c7f996594e991f2b"
|
|
],
|
|
"Namespace": "",
|
|
"IsInfra": false,
|
|
"Config": {
|
|
"Hostname": "6335b78454e6",
|
|
"Domainname": "",
|
|
"User": "",
|
|
"AttachStdin": false,
|
|
"AttachStdout": false,
|
|
"AttachStderr": false,
|
|
"Tty": true,
|
|
"OpenStdin": true,
|
|
"StdinOnce": false,
|
|
"Env": [
|
|
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
|
"TERM=xterm",
|
|
"container=oci",
|
|
"containers=podman",
|
|
"DISTTAG=f33container",
|
|
"FGC=f33",
|
|
"HOSTNAME=6335b78454e6",
|
|
"HOME=/root"
|
|
],
|
|
"Cmd": [
|
|
"/bin/bash"
|
|
],
|
|
"Image": "registry.fedoraproject.org/fedora:latest",
|
|
"Volumes": null,
|
|
"WorkingDir": "/",
|
|
"Entrypoint": "",
|
|
"OnBuild": null,
|
|
"Labels": {
|
|
"license": "MIT",
|
|
"name": "fedora",
|
|
"vendor": "Fedora Project",
|
|
"version": "33"
|
|
},
|
|
"Annotations": {
|
|
"io.container.manager": "libpod",
|
|
"io.kubernetes.cri-o.Created": "2020-11-24T20:06:25.852770272+01:00",
|
|
"io.kubernetes.cri-o.TTY": "true",
|
|
"io.podman.annotations.autoremove": "FALSE",
|
|
"io.podman.annotations.init": "FALSE",
|
|
"io.podman.annotations.privileged": "FALSE",
|
|
"io.podman.annotations.publish-all": "FALSE",
|
|
"org.opencontainers.image.stopSignal": "15"
|
|
},
|
|
"StopSignal": 15,
|
|
"CreateCommand": [
|
|
"/usr/bin/podman",
|
|
"run",
|
|
"--device",
|
|
"/dev/fb0",
|
|
"-it",
|
|
"fedora",
|
|
"/bin/bash"
|
|
],
|
|
"Umask": "0022"
|
|
},
|
|
"HostConfig": {
|
|
"Binds": [],
|
|
"CgroupMode": "private",
|
|
"ContainerIDFile": "",
|
|
"LogConfig": {
|
|
"Type": "k8s-file",
|
|
"Config": null
|
|
},
|
|
"NetworkMode": "bridge",
|
|
"PortBindings": {},
|
|
"RestartPolicy": {
|
|
"Name": "",
|
|
"MaximumRetryCount": 0
|
|
},
|
|
"AutoRemove": false,
|
|
"VolumeDriver": "",
|
|
"VolumesFrom": null,
|
|
"CapAdd": [],
|
|
"CapDrop": [],
|
|
"Dns": [],
|
|
"DnsOptions": [],
|
|
"DnsSearch": [],
|
|
"ExtraHosts": [],
|
|
"GroupAdd": [],
|
|
"IpcMode": "private",
|
|
"Cgroup": "",
|
|
"Cgroups": "default",
|
|
"Links": null,
|
|
"OomScoreAdj": 0,
|
|
"PidMode": "private",
|
|
"Privileged": false,
|
|
"PublishAllPorts": false,
|
|
"ReadonlyRootfs": false,
|
|
"SecurityOpt": [],
|
|
"Tmpfs": {},
|
|
"UTSMode": "private",
|
|
"UsernsMode": "",
|
|
"ShmSize": 65536000,
|
|
"Runtime": "oci",
|
|
"ConsoleSize": [
|
|
0,
|
|
0
|
|
],
|
|
"Isolation": "",
|
|
"CpuShares": 0,
|
|
"Memory": 0,
|
|
"NanoCpus": 0,
|
|
"CgroupParent": "",
|
|
"BlkioWeight": 0,
|
|
"BlkioWeightDevice": null,
|
|
"BlkioDeviceReadBps": null,
|
|
"BlkioDeviceWriteBps": null,
|
|
"BlkioDeviceReadIOps": null,
|
|
"BlkioDeviceWriteIOps": null,
|
|
"CpuPeriod": 0,
|
|
"CpuQuota": 0,
|
|
"CpuRealtimePeriod": 0,
|
|
"CpuRealtimeRuntime": 0,
|
|
"CpusetCpus": "",
|
|
"CpusetMems": "",
|
|
"Devices": [
|
|
{
|
|
"PathOnHost": "/dev/fb0",
|
|
"PathInContainer": "/dev/fb0",
|
|
"CgroupPermissions": ""
|
|
}
|
|
],
|
|
"DiskQuota": 0,
|
|
"KernelMemory": 0,
|
|
"MemoryReservation": 0,
|
|
"MemorySwap": 0,
|
|
"MemorySwappiness": 0,
|
|
"OomKillDisable": false,
|
|
"PidsLimit": 2048,
|
|
"Ulimits": [
|
|
{
|
|
"Name": "RLIMIT_NOFILE",
|
|
"Soft": 1048576,
|
|
"Hard": 1048576
|
|
},
|
|
{
|
|
"Name": "RLIMIT_NPROC",
|
|
"Soft": 4194304,
|
|
"Hard": 4194304
|
|
}
|
|
],
|
|
"CpuCount": 0,
|
|
"CpuPercent": 0,
|
|
"IOMaximumIOps": 0,
|
|
"IOMaximumBandwidth": 0,
|
|
"CgroupConf": null
|
|
}
|
|
}
|
|
]
|