SELinux policy for runtime

[tsavola]

No description provided.

[wsandin]

I'd be happy to help out with that @tsavola

[tsavola]

Great to hear!

I threw together an AppArmor profile as I live in the Ubuntu/Debian world (however, there's an issue with it). It applies to the non-Go components (lib) which implement the containment of the user processes. They're the most sensitive and least volatile part.

The programs in bin are a secondary subject. They are built on the reusable Go packages, which leads me to think that a reusable core policy or a template might be helpful. I have no experience with SELinux so don't know what makes sense.

Did you get Gate built and working?

[wsandin]

Hi, thanks for the details. I'm working on setting up the build env now.

[wsandin]

I'm having some trouble building gate on CentOS 8. I had to change $CC to gcc instead of gcc-musl. I have all Development Tools (group package for x86-64 installed).

I'll try to work something out, but just wanted to share as an FYI in case you had any idea @tsavola.

[vagrant@localhost gate]$ cat /etc/centos-release
CentOS Linux release 8.0.1905 (Core) 
[vagrant@localhost gate]$ make
make -C runtime/container CGROUP_BACKEND=systemd
make[1]: Entering directory '/home/vagrant/gate/runtime/container'
mkdir -p ../../lib/gate/runtime/
ln -f ../../lib/runtime-container-cgroup-systemd ../../lib/gate/runtime/gate-runtime-container.0
make[1]: Leaving directory '/home/vagrant/gate/runtime/container'
make -C runtime/executor
make[1]: Entering directory '/home/vagrant/gate/runtime/executor'
mkdir -p ../../lib/gate/runtime/
gcc -std=gnu99 -O2 -fomit-frame-pointer -g -Wall -Wextra -Wno-unused-parameter -pthread -static -o ../../lib/gate/runtime/gate-runtime-executor.0 executor.o reaper.o sentinel.o
/usr/bin/ld: cannot find -lpthread
/usr/bin/ld: cannot find -lc
collect2: error: ld returned 1 exit status
make[1]: *** [Makefile:18: ../../lib/gate/runtime/gate-runtime-executor.0] Error 1
make[1]: Leaving directory '/home/vagrant/gate/runtime/executor'
make: *** [Makefile:34: lib] Error 2

[tsavola]

It might be due to -static. Maybe CentOS doesn't ship static libraries by default, and you need to install something more?

[wsandin]

Just resumed. Will try to reinstall it today on a fresh CentOS install.

[wsandin]

Sorry I don't think I'll be able to commit much to this as it needs a fair bit of customizations of CentOS (including installing musl) to make sense to bundle with SELinux unless there's a bundle of RPMs available first.

[tsavola]

Okay, no problem.