feat: add necessary SELinux allow rules

[dsseng]

Pull Request

What? (description)

Make everything work with SELinux

Why? (reasoning)

Improve security, #8016

Acceptance

Please use the following checklist:

• you linked an issue (if applicable)
• you included tests (if applicable)
• you ran conformance (make conformance)
• you formatted your code (make fmt)
• you linted your code (make lint)
• you generated documentation (make docs)
• you ran unit-tests (make unit-tests)

See make help for a description of the available targets.

Build SELinux policy without full generate step (might produce different results due to reliance on host tooling, but is faster):

secilc -o ./internal/pkg/selinux/policy/policy.33 -f ./internal/pkg/selinux/policy/file_contexts -c 33 ./internal/pkg/selinux/policy/selinux/**/*.cil -vvvvv -O

Read and analyze SELinux denials (make generate or alternative build required to match against the current policy):

talosctl --nodes 172.20.0.2 logs auditd > /tmp/audit.log && talosctl --nodes 172.20.0.3 logs auditd >> /tmp/audit.log && PYTHONPATH=/tmp/selinux/python/sepolgen/src python3 /tmp/selinux/python/audit2allow/audit2allow -C -p ./internal/pkg/selinux/policy/policy.33 -i /tmp/audit.log > /tmp/audit2allow.cil && PYTHONPATH=/tmp/selinux/python/sepolgen/src python3 /tmp/selinux/python/audit2allow/audit2allow -C -p ./internal/pkg/selinux/policy/policy.33 -e -i /tmp/audit.log > /tmp/audit2allow-explain.cil

Tip: to debug denials in QEMU:

secilc -c 33 selinux/**/*.cil -vvvvv && PYTHONPATH=/tmp/selinux/python/sepolgen/src python3 /tmp/selinux/python/audit2allow/audit2allow -i /tmp/tl-test-home/.talos/clusters/talos-default/talos-default-controlplane-1.log -C -p /tmp/talos/policy.33 > /tmp/audit2allow.cil && PYTHONPATH=/tmp/selinux/python/sepolgen/src python3 /tmp/selinux/python/audit2allow/audit2allow -i /tmp/tl-test-home/.talos/clusters/talos-default/talos-default-controlplane-1.log -C -p /tmp/talos/policy.33 -e > /tmp/audit2allow-explain.cil