Cockpit as a privileged container?

Trevor Jay tjay at redhat.com
Wed Aug 6 08:57:39 UTC 2014


On Tue, Aug 05, 2014 at 09:14:59AM -0400, Daniel J Walsh wrote:
> Well /proc is not only being blocked by SELinux, but also you are still
> entering a different PID namespace.
>

Fair enough, but with greater SELinux permissions /proc still gives you alot of process monitoring options.

> On 08/04/2014 10:57 PM, Trevor Jay wrote:
> > Speaking of that: you mentioned a "set" collection of
> > namespaces/privileges to choose from at container launch time. How clear
> > are those at this point? It would be good if we could whip up roughly
> > equivalent types now so that the cockpit guys could begin seeing what
> > they'd need to adjust.
> >
> Not really sure what you mean.  What exactly are you expecting, can you give
> me an example?
> 

Right now Docker containers run with either the svirt_lxc_net_t or docker_t types and we've provided pre-existing policies for those type. For example, we provide the svirt_sandbox_file_t type and policy scaffolding so that's it's easy to give Docker containers access to files.

With --selinux-opt=type:X opening up the possibility of running containers as more types, I'm asking if we intend to for our standard policy to provide more "canned" types for users to use or do we expect users to always roll their own?

_Trevor

-- 
Sent from my Amiga 500.
(Trevor Jay) Red Hat Product Security
gpg-key: https://ssl.montrose.is/chat/gpg-key


More information about the cockpit-devel mailing list