Add Support for --device /dev/XXX #78
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@JAORMX , is this applicable for CRI-O? |
Currently, there doesn't seem to be similar support for this in CRI-O or Kubernetes [1]. But what folks tend to do is bind-mount the device on to the container. With the current mount parsing, will udica still attach the appropriate policy for a device? |
|
Yes, bind-mount will work for container for both podman and CRI-O. Okay, Thank you for update, I'll drop TODO for CRI-O and move "Draft PR" to "PR". |
Commit adds functionality to generate allow rules when --device switch
is used for podman e.g: podman run --device /dev/tty0 fedora /bin/bash
The output policy should looks like:
(block devtest
(blockinherit container)
(allow process process ( capability ( audit_write chown dac_override fowner fsetid kill mknod net_bind_service net_raw setfcap setgid setpcap setuid sys_chroot )))
(allow process tty_device_t ( blk_file ( getattr read write append ioctl lock open )))
(allow process tty_device_t ( chr_file ( getattr read write append ioctl lock open )))
)
The feature is applicable for podman and docker engines, CRI-O uses
bind-mount solution.
JAORMX
approved these changes
Nov 25, 2020
|
@JAORMX Thank you. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Commit adds functionality to generate allow rules when --device switch
is used for podman e.g:
# podman run --device /dev/tty0 fedora /bin/bashThe output policy should looks like:
TODO: CRI-O functionality is missing