selinux: more policy cleanups

pkg/assets/selinux/assets_test.go

@@ -30,6 +30,11 @@ func TestGetPolicy(t *testing.T) {
 	}
 
 	testCases := []testCase{
+		{
+			name:          "latest", // at time of writing. Keep me updated!
+			ver:           platform.Version("v4.16"),
+			expectedError: false,
+		},
 		{
 			name:          "supported",
 			ver:           platform.Version("v4.12"),

pkg/assets/selinux/policy/ocp_v4.14.cil

@@ -20,6 +20,5 @@
 	;
 	; Allow to RTE pod connect, read and write permissions to /var/lib/kubelet/pod-resource/kubelet.sock
 	(allow process container_var_lib_t (sock_file (open getattr read write ioctl lock append)))
-	(allow process container_var_lib_t (unix_stream_socket (connectto)))
 	(allow process kubelet_t (unix_stream_socket (connectto)))
 )

pkg/assets/selinux/policy/ocp_v4.16.cil

@@ -0,0 +1,24 @@
+(block rte
+	(type process)
+	(roletype system_r process)
+	(typeattributeset domain (process))
+	;
+	; Giving rte.process the same attributes as container_t
+	(typeattributeset container_domain (process))
+	(typeattributeset container_net_domain (process))
+	(typeattributeset svirt_sandbox_domain (process))
+	(typeattributeset sandbox_net_domain (process))
+	; MCS is leveraged by container_t and others, like us, to prevent cross-pod communication.
+	(typeattributeset mcs_constrained_type (process))
+	;
+	; Allow access to procfs (also needed by libraries)
+	(allow process proc_type (file (open read)))
+	;
+	; Allow to RTE pod access to /run/rte directory
+	(allow process container_var_run_t (dir (add_name write)))
+	(allow process container_var_run_t (file (create read write open)))
+	;
+	; Allow to RTE pod connect, read and write permissions to /var/lib/kubelet/pod-resource/kubelet.sock
+	(allow process container_var_lib_t (sock_file (open getattr read write ioctl lock append)))
+	(allow process kubelet_t (unix_stream_socket (connectto)))
+)

pkg/commands/render.go

@@ -23,6 +23,7 @@ import (
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	selinuxassets "github.com/k8stopologyawareschedwg/deployer/pkg/assets/selinux"
 	"github.com/k8stopologyawareschedwg/deployer/pkg/deploy"
 	"github.com/k8stopologyawareschedwg/deployer/pkg/deployer"
 	"github.com/k8stopologyawareschedwg/deployer/pkg/deployer/platform"
@@ -50,6 +51,7 @@ func NewRenderCommand(env *deployer.Environment, commonOpts *deploy.Options) *co
 	render.AddCommand(NewRenderAPICommand(env, commonOpts, opts))
 	render.AddCommand(NewRenderSchedulerPluginCommand(env, commonOpts, opts))
 	render.AddCommand(NewRenderTopologyUpdaterCommand(env, commonOpts, opts))
+	render.AddCommand(NewRenderPolicyCommand(env, commonOpts, opts))
 	return render
 }
 
@@ -191,3 +193,23 @@ func RenderManifests(env *deployer.Environment, commonOpts *deploy.Options) erro
 
 	return manifests.RenderObjects(objs, os.Stdout)
 }
+
+func NewRenderPolicyCommand(env *deployer.Environment, commonOpts *deploy.Options, opts *RenderOptions) *cobra.Command {
+	render := &cobra.Command{
+		Use:   "policy",
+		Short: "render the SELinux policy needed for topology-aware-scheduling",
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if commonOpts.UserPlatform != platform.OpenShift {
+				return fmt.Errorf("must explicitly select the OpenShift platform")
+			}
+			selinuxPolicy, err := selinuxassets.GetPolicy(commonOpts.UserPlatformVersion)
+			if err != nil {
+				return err
+			}
+			_, err = os.Stdout.Write(selinuxPolicy)
+			return err
+		},
+		Args: cobra.NoArgs,
+	}
+	return render
+}