Skip to content

Commit

Permalink
operator security-profiles-operator (0.8.2)
Browse files Browse the repository at this point in the history
  • Loading branch information
@saschagrunert
saschagrunert authored Dec 19, 2023
1 parent 6b56440 commit aab981a
Show file tree
Hide file tree
Showing 25 changed files with 3,939 additions and 0 deletions.
9 changes: 9 additions & 0 deletions operators/security-profiles-operator/0.8.2/manifests/metrics-token_v1_secret.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
apiVersion: v1
kind: Secret
metadata:
annotations:
kubernetes.io/service-account.name: default
labels:
app: security-profiles-operator
name: metrics-token
type: kubernetes.io/service-account-token
165 changes: 165 additions & 0 deletions ...ty-profiles-operator/0.8.2/manifests/security-profiles-operator-profile_v1_configmap.yaml
View file
Original file line number Diff line number Diff line change
@@ -0,0 +1,165 @@
apiVersion: v1
data:
security-profiles-operator.json: |
{
"defaultAction": "SCMP_ACT_ERRNO",
"architectures": [
"SCMP_ARCH_X86_64",
"SCMP_ARCH_X86",
"SCMP_ARCH_X32",
"SCMP_ARCH_AARCH64"
],
"syscalls": [
{
"names": [
"accept4",
"access",
"arch_prctl",
"bind",
"brk",
"capget",
"capset",
"chdir",
"clone",
"clone3",
"close",
"connect",
"epoll_create1",
"epoll_ctl",
"epoll_pwait",
"epoll_wait",
"execve",
"exit",
"exit_group",
"fchown",
"fcntl",
"flock",
"fstat",
"fstatfs",
"fsync",
"futex",
"getcwd",
"getdents64",
"getgid",
"getpeername",
"getpgrp",
"getpid",
"getppid",
"getrandom",
"getrlimit",
"getsockname",
"getsockopt",
"gettid",
"getuid",
"inotify_add_watch",
"inotify_init1",
"listen",
"lseek",
"madvise",
"membarrier",
"mkdirat",
"mlock",
"mmap",
"mprotect",
"munmap",
"nanosleep",
"newfstatat",
"open",
"openat",
"pipe2",
"prctl",
"pread64",
"prlimit64",
"read",
"readlink",
"readlinkat",
"renameat",
"rseq",
"rt_sigaction",
"rt_sigprocmask",
"rt_sigreturn",
"sched_getaffinity",
"sched_yield",
"set_robust_list",
"set_tid_address",
"setgid",
"setgroups",
"setsockopt",
"setuid",
"sigaltstack",
"socket",
"tgkill",
"time",
"uname",
"unlinkat",
"write"
],
"action": "SCMP_ACT_ALLOW"
}
]
}
selinuxd-image-mapping.json: |
[
{
"regex":"(.*)(CoreOS).*([\\d+])\\.8[\\d+]\\.(.*)",
"imageFromVar":"RELATED_IMAGE_SELINUXD_EL8"
},
{
"regex":"(.*)(CoreOS).*([\\d+])\\.9[\\d+]\\.(.*)",
"imageFromVar":"RELATED_IMAGE_SELINUXD_EL9"
}
]
selinuxd.cil: |
(block selinuxd
(blockinherit container)
(allow process process ( capability ( dac_override dac_read_search lease audit_write audit_control )))
(allow process default_context_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process default_context_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process default_context_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process default_context_t ( sock_file ( append getattr open read write )))
(allow process etc_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write watch )))
(allow process etc_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process etc_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process etc_t ( sock_file ( append getattr open read write )))
(allow process file_context_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process file_context_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process file_context_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process file_context_t ( sock_file ( append getattr open read write )))
(allow process security_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process security_t ( security ( load_policy )))
(allow process selinux_config_t ( dir ( add_name create getattr ioctl lock open read remove_name rename rmdir search setattr write )))
(allow process selinux_config_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process selinux_config_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process selinux_config_t ( sock_file ( append getattr open read write )))
(allow process selinux_login_config_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process selinux_login_config_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process selinux_login_config_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process selinux_login_config_t ( sock_file ( append getattr open read write )))
(allow process semanage_read_lock_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process semanage_read_lock_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process semanage_read_lock_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process semanage_read_lock_t ( sock_file ( append getattr open read write )))
(allow process semanage_store_t ( dir ( add_name create getattr ioctl lock open read rename remove_name rmdir search setattr write )))
(allow process semanage_store_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process semanage_store_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process semanage_store_t ( sock_file ( append getattr open read write )))
(allow process semanage_trans_lock_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process semanage_trans_lock_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process semanage_trans_lock_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process semanage_trans_lock_t ( sock_file ( append getattr open read write )))
(allow process sysfs_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
(allow process sysfs_t ( fifo_file ( getattr read write append ioctl lock open )))
(allow process sysfs_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
(allow process sysfs_t ( sock_file ( append getattr open read write )))
)
selinuxrecording.cil: |
(block selinuxrecording
(blockinherit container)
(typepermissive process)
)
kind: ConfigMap
metadata:
labels:
app: security-profiles-operator
name: security-profiles-operator-profile
Loading

0 comments on commit aab981a

Please sign in to comment.