{ "info": { "author": "Lukas Vrabec", "author_email": "lvrabec@redhat.com", "bugtrack_url": null, "classifiers": [ "License :: OSI Approved :: GNU General Public License v3 or later (GPLv3+)", "Operating System :: OS Independent", "Programming Language :: Python :: 3" ], "description": "![UDICA logo](logo/logo-udica.svg)\n\n# udica - Generate SELinux policies for containers!\n\n\n[![Build Status](https://travis-ci.org/containers/udica.svg?branch=master)](https://travis-ci.org/containers/udica)\n\n# Overview\n\nThis repository contains a tool for generating SELinux security profiles for containers. The whole concept is based on \"block inheritence\" feature inside CIL intermediate language supported by SELinux userspace. The tool creates a policy which combines rules inherited from specified CIL blocks(templates) and rules discovered by inspection of container JSON file, which contains mountpoints and ports definitions.\n\nFinal policy could be loaded immediately or moved to another system where it could be loaded via semodule.\n\n## What's with the weird name?\nThe name of this tool is derived from the Slovak word \"udica\" *\\[u\u025fit\u0361sa\\]*, which means \"fishing rod\". It is a reference to the saying *\"Give a man a fish and you feed him for a day; teach a man to fish and you feed him for a lifetime.\"* Here udica is the fishing rod that allows you to get the fish (container policy) yourself, instead of always having to ask your local fisherman (SELinux expert) to catch (create) it for you ;)\n\n## State\n\nThis tool is still in early phase of development. Any feedback, ideas, pull requests are welcome. We're still adding new features, parameters and policy blocks which could be used.\n\n## Proof of concept\n\nTool was created based on following PoC where process of creating policy is described:\nhttps://github.com/fedora-selinux/container-selinux-customization\n\n## Supported container engines\n\nUdica supports following container engines:\n * CRI-O v1.14.10+\n * docker v1.13+\n * podman v2.0+\n\n## Installing\n\nInstall udica tool with all dependencies\n\n $ sudo dnf install -y podman setools-console git container-selinux\n $ git clone https://github.com/containers/udica\n $ cd udica && sudo python3 ./setup.py install\n\nAlternatively you can run udica directly from git:\n\n $ python3 -m udica --help\n\nAnother way how to install udica is to use fedora repository:\n\n # dnf install udica -y\n\nOr you can use Python Package Index (Pypi):\n\n # pip install udica\n\nMake sure that SELinux is in Enforcing mode\n\n # setenforce 1\n # getenforce\n Enforcing\n\n## Current situation\n\nLet's start podman container with following parameters:\n\n # podman run -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash\n\n - Container will bind mount /home with read only perms\n - Container will bind mount /var/spool with read/write perms\n - Container will publish container's port 21 to the host\n\nContainer runs with **container\\_t** type and **c447,c628** categories.\n\nAccess mounted */home* is not working:\n\n [root@37a3635afb8f /]# cd /home/\n [root@37a3635afb8f home]# ls\n ls: cannot open directory '.': Permission denied\n\nBecause there is no allow rule for **container\\_t** to access */home*\n\n # sesearch -A -s container_t -t home_root_t\n #\n\nAccess mounted */var/spool* is not working:\n\n [root@37a3635afb8f home]# cd /var/spool/\n [root@37a3635afb8f spool]# ls\n ls: cannot open directory '.': Permission denied\n [root@37a3635afb8f spool]# touch test\n touch: cannot touch 'test': Permission denied\n\nBecause there is no allow rule for **container\\_t** to access */var/spool*\n\n # sesearch -A -s container_t -t var_spool_t -c dir -p read\n #\n\nOn the other hand, what is completely allowed is network access.\n\n # sesearch -A -s container_t -t port_type -c tcp_socket\n allow container_net_domain port_type:tcp_socket { name_bind name_connect recv_msg send_msg };\n allow sandbox_net_domain port_type:tcp_socket { name_bind name_connect recv_msg send_msg };\n\n # sesearch -A -s container_t -t port_type -c udp_socket\n allow container_net_domain port_type:udp_socket { name_bind recv_msg send_msg };\n allow sandbox_net_domain port_type:udp_socket { name_bind recv_msg send_msg };\n\nIt would be great to restrict this access and allow container bind just on tcp port *21* or with the same label.\n\n## Creating SELinux policy for container\n\nTo create policy for container, it's necessary to have running container for which a policy will be generated. Container from previous chapter will be used.\n\nLet's find container id using *podman ps* command:\n\n # podman ps\n CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES\n 37a3635afb8f docker.io/library/fedora:latest bash 15 minutes ago Up 15 minutes ago heuristic_lewin\n\nContainer ID is **37a3635afb8f**.\n\nTo create policy for it **udica** tool could be used. Parameter '*-j*' is for *container json file* and SELinux policy *name* for container.\n\n # podman inspect 37a3635afb8f > container.json\n # udica -j container.json my_container\n\nor\n\n # podman inspect 37a3635afb8f | udica my_container\n\n Policy my_container with container id 37a3635afb8f created!\n\n Please load these modules using:\n # semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}\n\n Restart the container with: \"--security-opt label=type:my_container.process\" parameter\n\nPolicy is generated. Let's follow instructions from output:\n\n # semodule -i my_container.cil /usr/share/udica/templates/{base_container.cil,net_container.cil,home_container.cil}\n\n # podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash\n\nContainer is now running with **my\\_container.process** type:\n\n # ps -efZ | grep my_container.process\n unconfined_u:system_r:container_runtime_t:s0-s0:c0.c1023 root 2275 434 1 13:49 pts/1 00:00:00 podman run --security-opt label=type:my_container.process -v /home:/home:ro -v /var/spool:/var/spool:rw -p 21:21 -it fedora bash\n system_u:system_r:my_container.process:s0:c270,c963 root 2317 2305 0 13:49 pts/0 00:00:00 bash\n\nProof that SELinux now allowing access */home* and */var/spool* mount points:\n\n [root@814ec56079e5 /]# cd /home\n [root@814ec56079e5 home]# ls\n lvrabec\n\n [root@814ec56079e5 ~]# cd /var/spool/\n [root@814ec56079e5 spool]# touch test\n [root@814ec56079e5 spool]#\n\nProof that SELinux allows binding only to tcp/udp *21* port.\n\n [root@5bd8cb2ad911 /]# nc -lvp 21\n Ncat: Version 7.60 ( https://nmap.org/ncat )\n Ncat: Generating a temporary 1024-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.\n Ncat: SHA-1 fingerprint: 6EEC 102E 6666 5F96 CC4F E5FA A1BE 4A5E 6C76 B6DC\n Ncat: Listening on :::21\n Ncat: Listening on 0.0.0.0:21\n\n [root@5bd8cb2ad911 /]# nc -lvp 80\n Ncat: Version 7.60 ( https://nmap.org/ncat )\n Ncat: Generating a temporary 1024-bit RSA key. Use --ssl-key and --ssl-cert to use a permanent one.\n Ncat: SHA-1 fingerprint: 6EEC 102E 6666 5F96 CC4F E5FA A1BE 4A5E 6C76 B6DC\n Ncat: bind to :::80: Permission denied. QUITTING.\n\n## Running from a container\n\nTo build the udica container to your local registry, run the following command:\n\n $ make image\n\nOnce having the image built, it's possible to run udica from whithin a\ncontainer. The necessary directories to bind-mount are:\n\n* `/sys/fs/selinux`\n* `/etc/selinux/`\n* `/var/lib/selinux/`\n\nFor reference, this would be a way to call the container via podman:\n\n podman run --user root --privileged -ti \\\n -v /sys/fs/selinux:/sys/fs/selinux \\\n -v /etc/selinux/:/etc/selinux/ \\\n -v /var/lib/selinux/:/var/lib/selinux/ \\\n --rm --name=udica udica\n\n## Testing\n\nUdica repository contains units tests for basic functionality of the tool. To run tests follow these commands:\n\n $ make test\n\nOn SELinux enabled systems you can run also (root access required):\n\n # python3 tests/test_integration.py\n\n## Udica in OpenShift\n\nUdica could run in OpenShift and generate SELinux policies for pods in the same instance.\n[SELinux policy helper operator](https://github.com/JAORMX/selinux-policy-helper-operator) is a controller that listens to all pods in the system. It will attempt to generate a policy for pods when the pod is annotated with a specific tag \"generate-selinux-policy\" and the pod is in a running state. In order to generate the policy, it spawns a pod with the [selinux-k8s](https://github.com/JAORMX/selinux-k8s) tool which uses udica to generate the policy. It will spit out a configmap with the appropriate policy.\n\nReal example is demonstrated in following demo.\n\n### Demo\n\n[![asciicast](https://asciinema.org/a/RnjsiiQYRDiLcB8hbhKiIJF5B.svg)](https://asciinema.org/a/RnjsiiQYRDiLcB8hbhKiIJF5B)\n\n## Known issues\n\n * It's not possible to detect capabilities used by container in docker engine, therefore you *have to* use '-c' to specify capabilities for docker container manually.\n * It's not possible to generate custom local policy using \"audit2allow -M\" tool from AVCs where source context was generated by udica. For this purpose please use '--append-rules' option.\n * In some situations udica fails to identify which container engine is used, therefore \"--container-engine\" parameter has to be used to inform udica how JSON inspection file should be parsed.", "description_content_type": "text/markdown", "docs_url": null, "download_url": "", "downloads": { "last_day": -1, "last_month": -1, "last_week": -1 }, "home_page": "https://github.com/containers/udica", "keywords": "", "license": "GPLv3+", "maintainer": "", "maintainer_email": "", "name": "udica", "package_url": "https://pypi.org/project/udica/", "platform": "", "project_url": "https://pypi.org/project/udica/", "project_urls": { "Homepage": "https://github.com/containers/udica" }, "release_url": "https://pypi.org/project/udica/0.2.3/", "requires_dist": null, "requires_python": "", "summary": "A tool for generating SELinux security policies for containers", "version": "0.2.3", "yanked": false, "yanked_reason": null }, "last_serial": 7966883, "releases": { "0.1.1": [ { "comment_text": "", "digests": { "md5": "1ac0c11be06d6d112e39f85d98d4ea94", "sha256": "bf5c409590e19a1f17ee3134283f445797b769b91bc326165fadabb49e4bd6d3" }, "downloads": -1, "filename": "udica-0.1.1-py3-none-any.whl", "has_sig": false, "md5_digest": "1ac0c11be06d6d112e39f85d98d4ea94", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": null, "size": 29125, "upload_time": "2018-10-27T21:51:23", "upload_time_iso_8601": "2018-10-27T21:51:23.621919Z", "url": "https://files.pythonhosted.org/packages/e8/56/80ffc8a920c6228a2ee4f5c0a9941ddf94ec29a8a12bdcca78a89eddf651/udica-0.1.1-py3-none-any.whl", "yanked": false, "yanked_reason": null } ], "0.1.3": [ { "comment_text": "", "digests": { "md5": "2a14fcd7d562dcc142dc4085afcfe8f0", "sha256": "783388b5c7f9ba281b8f7c9e03f7030af98a6e64883976956dd5dd7888a34e33" }, "downloads": -1, "filename": "udica-0.1.3.tar.gz", "has_sig": false, "md5_digest": "2a14fcd7d562dcc142dc4085afcfe8f0", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 21540, "upload_time": "2019-03-07T13:17:25", "upload_time_iso_8601": "2019-03-07T13:17:25.896568Z", "url": "https://files.pythonhosted.org/packages/f6/53/889c0e34f03ed6b525de55081e9df23ec69dd230dfc5ab3994e93bd0fc83/udica-0.1.3.tar.gz", "yanked": false, "yanked_reason": null } ], "0.1.4": [ { "comment_text": "", "digests": { "md5": "725099cd13cfb9482f8359d2e96a4ded", "sha256": "5411b3ba98c0f2382a5272806df8401e85bbf65725e6fcde761b4ca9b42f0585" }, "downloads": -1, "filename": "udica-0.1.4.tar.gz", "has_sig": false, "md5_digest": "725099cd13cfb9482f8359d2e96a4ded", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 23784, "upload_time": "2019-03-11T12:47:49", "upload_time_iso_8601": "2019-03-11T12:47:49.205337Z", "url": "https://files.pythonhosted.org/packages/7e/69/31d45fa1db16941633a0a529a4a48306fc9cae8d58e7b11102e52e4a487e/udica-0.1.4.tar.gz", "yanked": false, "yanked_reason": null } ], "0.1.5": [ { "comment_text": "", "digests": { "md5": "0849cbaf092c6af9ee57d288eae8038f", "sha256": "51db48c2536c2b694eb6dacb2255eb0af1e3c6bbf47c13125b3dda66a71e4551" }, "downloads": -1, "filename": "udica-0.1.5-py3-none-any.whl", "has_sig": false, "md5_digest": "0849cbaf092c6af9ee57d288eae8038f", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": null, "size": 26272, "upload_time": "2019-05-20T08:15:57", "upload_time_iso_8601": "2019-05-20T08:15:57.208144Z", "url": "https://files.pythonhosted.org/packages/33/44/4835cb7d63a0e4a220e3e264c7de335d8cdffaab154599557a324b3daf2a/udica-0.1.5-py3-none-any.whl", "yanked": false, "yanked_reason": null }, { "comment_text": "", "digests": { "md5": "6d7cb4fa1d51e3a8d49a3cb6d4e04659", "sha256": "c9ddc1820a6e8f9e79146d9622c2ddb9770c5eb84c0f4cc19be57344d4021e1e" }, "downloads": -1, "filename": "udica-0.1.5.tar.gz", "has_sig": false, "md5_digest": "6d7cb4fa1d51e3a8d49a3cb6d4e04659", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 23844, "upload_time": "2019-04-19T18:40:15", "upload_time_iso_8601": "2019-04-19T18:40:15.104870Z", "url": "https://files.pythonhosted.org/packages/c7/35/d1aeac37e8dbc9607dc8e2f8e670160e239704eb9e25e746d8644876c5e2/udica-0.1.5.tar.gz", "yanked": false, "yanked_reason": null } ], "0.1.6": [ { "comment_text": "", "digests": { "md5": "a2f709b7b20a16034c26244bc8c51529", "sha256": "9826d58bc4cf60f83b9986390f42158b725257a3cc9f505fd64aaa1f8ca2bd5b" }, "downloads": -1, "filename": "udica-0.1.6-py3-none-any.whl", "has_sig": false, "md5_digest": "a2f709b7b20a16034c26244bc8c51529", "packagetype": "bdist_wheel", "python_version": "py3", "requires_python": null, "size": 26271, "upload_time": "2019-05-20T08:17:53", "upload_time_iso_8601": "2019-05-20T08:17:53.806394Z", "url": "https://files.pythonhosted.org/packages/4e/8a/641f653ab83dc36f97009fc75be6a9de744df447983f1eb524dc095b2739/udica-0.1.6-py3-none-any.whl", "yanked": false, "yanked_reason": null } ], "0.1.7": [ { "comment_text": "", "digests": { "md5": "4acbdd270b4dce778b9942d9933600bf", "sha256": "2c23bab34aa132f78056fd6cc25944b157a8aed8485fb0fd672ed48e0eb594f0" }, "downloads": -1, "filename": "udica-0.1.7.tar.gz", "has_sig": false, "md5_digest": "4acbdd270b4dce778b9942d9933600bf", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 25324, "upload_time": "2019-06-15T14:29:15", "upload_time_iso_8601": "2019-06-15T14:29:15.386168Z", "url": "https://files.pythonhosted.org/packages/ff/d9/ad97572e91dcba176994d28e0bb9570bdf447627fd50043d21264917f337/udica-0.1.7.tar.gz", "yanked": false, "yanked_reason": null } ], "0.1.8": [ { "comment_text": "", "digests": { "md5": "fede1a7d6c755b7ee85cee1422b8f752", "sha256": "224a44f76702d43ed81b013e9cbd0a5631e315d6e649fc7b9db63061e3960997" }, "downloads": -1, "filename": "udica-0.1.8.tar.gz", "has_sig": false, "md5_digest": "fede1a7d6c755b7ee85cee1422b8f752", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 25418, "upload_time": "2019-07-11T11:10:55", "upload_time_iso_8601": "2019-07-11T11:10:55.726264Z", "url": "https://files.pythonhosted.org/packages/62/a3/ed2778435ee0b34ad8b5484d9ad89e555751ccb68042266a0ee143db6dca/udica-0.1.8.tar.gz", "yanked": false, "yanked_reason": null } ], "0.1.9": [ { "comment_text": "", "digests": { "md5": "0f80bc1757df8015776cfbf1cc958186", "sha256": "1f16cfa03e2a950d0ecb93c903aa9dab5ffb994949372976ecb8b3dccb16469c" }, "downloads": -1, "filename": "udica-0.1.9.tar.gz", "has_sig": false, "md5_digest": "0f80bc1757df8015776cfbf1cc958186", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 23740, "upload_time": "2019-09-17T07:03:04", "upload_time_iso_8601": "2019-09-17T07:03:04.924966Z", "url": "https://files.pythonhosted.org/packages/5d/90/dce90292f7b4bdf9f3762613832eb44186fb2260575be3c5271a1e84de35/udica-0.1.9.tar.gz", "yanked": false, "yanked_reason": null } ], "0.2.0": [ { "comment_text": "", "digests": { "md5": "71c9aa3d522cfd74a37717ab62aecf0a", "sha256": "a2372cedb4d704a0462e8936d6103e952f444a877df98c7921ce7e806a349a07" }, "downloads": -1, "filename": "udica-0.2.0.tar.gz", "has_sig": false, "md5_digest": "71c9aa3d522cfd74a37717ab62aecf0a", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 28076, "upload_time": "2019-09-25T08:51:34", "upload_time_iso_8601": "2019-09-25T08:51:34.254781Z", "url": "https://files.pythonhosted.org/packages/b3/8d/6962149a309e14e9ed462d1569b36738b1ee1337e5533b1725dd96278d02/udica-0.2.0.tar.gz", "yanked": false, "yanked_reason": null } ], "0.2.1": [ { "comment_text": "", "digests": { "md5": "a2183716b45001e6dbb2f2cdfc75621d", "sha256": "1e43f2d0ac4ee7392910bd448a545c9d88cf57631704e8484a6f21c310075fc1" }, "downloads": -1, "filename": "udica-0.2.1-py3.7.egg", "has_sig": false, "md5_digest": "a2183716b45001e6dbb2f2cdfc75621d", "packagetype": "bdist_egg", "python_version": "3.7", "requires_python": null, "size": 23525, "upload_time": "2020-08-03T17:09:19", "upload_time_iso_8601": "2020-08-03T17:09:19.497338Z", "url": "https://files.pythonhosted.org/packages/34/b6/c0a10dd3d013f8a5018104a448807472376f41affa01bb5e27f5a8103ea6/udica-0.2.1-py3.7.egg", "yanked": false, "yanked_reason": null }, { "comment_text": "", "digests": { "md5": "786d1d3da1806f224b3f577f23b14383", "sha256": "7e4906064329a2fc46d9941995bf1ce0c90147aefb1cf13bb0120baea48daf14" }, "downloads": -1, "filename": "udica-0.2.1.tar.gz", "has_sig": false, "md5_digest": "786d1d3da1806f224b3f577f23b14383", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 25566, "upload_time": "2019-10-25T20:12:44", "upload_time_iso_8601": "2019-10-25T20:12:44.719379Z", "url": "https://files.pythonhosted.org/packages/f8/a2/fc4acc53ea6efce2f3b85720d8de36ce834faf12289ccefb54d8ad9117cb/udica-0.2.1.tar.gz", "yanked": false, "yanked_reason": null } ], "0.2.2": [ { "comment_text": "", "digests": { "md5": "7a185437066bc827c6e8892257710810", "sha256": "42d12f6b8e7de613569d05888f5a99a10f480bebc71fc4966731401e86016751" }, "downloads": -1, "filename": "udica-0.2.2-py3.7.egg", "has_sig": false, "md5_digest": "7a185437066bc827c6e8892257710810", "packagetype": "bdist_egg", "python_version": "3.7", "requires_python": null, "size": 24746, "upload_time": "2020-08-15T10:24:36", "upload_time_iso_8601": "2020-08-15T10:24:36.952982Z", "url": "https://files.pythonhosted.org/packages/c7/ce/c591ba96739b6bad3d521d4e7cabdba756d1dfcff299f0824356116896d0/udica-0.2.2-py3.7.egg", "yanked": false, "yanked_reason": null }, { "comment_text": "", "digests": { "md5": "279d93d5496649f662db3263c5c5d19b", "sha256": "cea817f25b77a815e5ad135e2863de4bf7a41049f2a6409c8e2d6fd18c38f1f6" }, "downloads": -1, "filename": "udica-0.2.2.tar.gz", "has_sig": false, "md5_digest": "279d93d5496649f662db3263c5c5d19b", "packagetype": "sdist", "python_version": "source", "requires_python": null, "size": 28847, "upload_time": "2020-08-03T17:09:21", "upload_time_iso_8601": "2020-08-03T17:09:21.777482Z", "url": "https://files.pythonhosted.org/packages/fa/55/5b5b0a3c1ce2abf79e602d3ee14d3095513e348abb07437bbdb66078d882/udica-0.2.2.tar.gz", "yanked": false, "yanked_reason": null } ], "0.2.3": [ { "comment_text": "", "digests": { "md5": "c953191232d77b60ba3db54d69b7b693", "sha256": "25a87d4528fd916e01096732f66f2fab872b7f8924e1ad5e69758796111e1f27" }, "downloads": -1, "filename": "udica-0.2.3-py3.8.egg", "has_sig": false, "md5_digest": "c953191232d77b60ba3db54d69b7b693", "packagetype": "bdist_egg", "python_version": "3.8", "requires_python": null, "size": 24842, "upload_time": "2020-08-15T10:24:40", "upload_time_iso_8601": "2020-08-15T10:24:40.059043Z", "url": "https://files.pythonhosted.org/packages/ad/6c/896d3c1bc26fbe851f31fe4256df9ddf8ae8e253547d274359c2460fe330/udica-0.2.3-py3.8.egg", "yanked": false, "yanked_reason": null } ] }, "urls": [ { "comment_text": "", "digests": { "md5": "c953191232d77b60ba3db54d69b7b693", "sha256": "25a87d4528fd916e01096732f66f2fab872b7f8924e1ad5e69758796111e1f27" }, "downloads": -1, "filename": "udica-0.2.3-py3.8.egg", "has_sig": false, "md5_digest": "c953191232d77b60ba3db54d69b7b693", "packagetype": "bdist_egg", "python_version": "3.8", "requires_python": null, "size": 24842, "upload_time": "2020-08-15T10:24:40", "upload_time_iso_8601": "2020-08-15T10:24:40.059043Z", "url": "https://files.pythonhosted.org/packages/ad/6c/896d3c1bc26fbe851f31fe4256df9ddf8ae8e253547d274359c2460fe330/udica-0.2.3-py3.8.egg", "yanked": false, "yanked_reason": null } ], "vulnerabilities": [] }