Support for wayland GUI apps

[panManfredini]

Hi!

Running Fedora 44 with GNOME 50, podman 5.8.4, udica 0.2.8.

I would like to create a SeLinux hardened container for development and I'd like to run some wayland-GUI apps in it. Seems like wayland is not supported in udica, I see a command-line option --X-access, but nothing related to wayland.

I tried to create policies for the following container

podman create --name dev  --volume $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY:$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY   --device /dev/dri   --volume /dev/dri:/dev/dri    --env WAYLAND_DISPLAY=$WAYLAND_DISPLAY   --env XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR   --env XDG_SESSION_TYPE=wayland   registry.fedoraproject.org/fedora-toolbox:44 

and I get the following policies:

(block dev1
    (blockinherit container)
    (blockinherit net_container)
    (allow process process ( capability ( chown dac_override fowner fsetid kill net_bind_service setfcap setgid setpcap setuid sys_chroot ))) 

    (allow process device_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write ))) 
    (allow process device_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write ))) 
    (allow process device_t ( fifo_file ( getattr read write append ioctl lock open ))) 
    (allow process device_t ( sock_file ( append getattr open read write ))) 
    (allow process dri_device_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write ))) 
    (allow process dri_device_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write ))) 
    (allow process dri_device_t ( fifo_file ( getattr read write append ioctl lock open ))) 
    (allow process dri_device_t ( sock_file ( append getattr open read write ))) 
    (allow process user_tmp_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write ))) 
    (allow process user_tmp_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write ))) 
    (allow process user_tmp_t ( fifo_file ( getattr read write append ioctl lock open ))) 
    (allow process user_tmp_t ( sock_file ( append getattr open read write ))) 
)

Once policies are applied and the container is created again as per instructions, I get the following SELinux denial, (turning off selinux the container works as expected):

type=AVC msg=audit(1787091879.983:2076): avc:  denied  { connectto } for  pid=35905 comm="wayland-info" path="/run/user/1000/wayland-0" scontext=system_u:system_r:dev1.process:s0:c214,c943 tcontext=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 tclass=unix_stream_socket permissive=0

I guess this is more complicated and would require some special additional policies as with the --X-acces, or Am I doing something wrong?

Thanks for this very nice package!

[vmojzis]

Hi, I have not tried working with Wayland. --X-access is a step in the right direction, but apparently does not provide all the necessary permissions. You can try running the container in permissive mode and then using the --append-rules udica option to improve the policy.

[panManfredini]

Thanks!
the --append-rules somehow didn't work for me, I added the output of audit2allow directly to the generated policy file. Also I think that --X-acces is actually not needed, but I didn't try without yet.

I ended up adding the following rules, for my special purpose of running an IDE (vscode) directly in the container and now it works:

    ;; needed to connect to wayland socket
    (allow process unconfined_t (unix_stream_socket (connectto)))

    ;; needed for app functioning, not strictly related to wayland
    (allow process devpts_t (filesystem (mount)))
    (allow process tmpfs_t (dir (mounton create)))
    (allow process tmpfs_t (file (map)))
    (allow process tmpfs_t (file (mounton create execute open)))
    (allow process tmpfs_t (lnk_file (create)))
    (allow process container_file_t (filesystem (unmount)))

Not sure why the process of the wayland socket is labelled as unconfined_t, maybe this is a GNOME thing.

For the records this is the original container to be used to extract the policy with udica:

podman create  --init --name dev   --network=bridge --hostname devbox --userns=keep-id  --user developer:developer  --volume $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY:$XDG_RUNTIME_DIR/$WAYLAND_DISPLAY  -v $XDG_RUNTIME_DIR/bus:$XDG_RUNTIME_DIR/bus:ro  --device /dev/dri   --volume /dev/dri:/dev/dri:ro   --env WAYLAND_DISPLAY=$WAYLAND_DISPLAY   --env XDG_RUNTIME_DIR=$XDG_RUNTIME_DIR   --env XDG_SESSION_TYPE=wayland  --shm-size=2g  fedora-wayland2  sleep infinity

And here the complete final policy:

(block dev
    (blockinherit container)
    (blockinherit net_container)
    (blockinherit x_container)
    (allow process user_tmp_t ( dir ( add_name create getattr ioctl lock open read remove_name rmdir search setattr write )))
    (allow process user_tmp_t ( file ( append create getattr ioctl lock map open read rename setattr unlink write )))
    (allow process user_tmp_t ( fifo_file ( getattr read write append ioctl lock open )))
    (allow process user_tmp_t ( sock_file ( append getattr open read write )))
    (allow process device_t ( dir ( getattr ioctl lock open read search )))
    (allow process device_t ( file ( getattr ioctl lock open read )))
    (allow process device_t ( fifo_file ( getattr open read lock ioctl )))
    (allow process device_t ( sock_file ( getattr open read )))
    (allow process dri_device_t ( dir ( getattr ioctl lock open read search )))
    (allow process dri_device_t ( file ( getattr ioctl lock open read )))
    (allow process dri_device_t ( fifo_file ( getattr open read lock ioctl )))
    (allow process dri_device_t ( sock_file ( getattr open read )))
    (allow process session_dbusd_tmp_t ( dir ( getattr ioctl lock open read search )))
    (allow process session_dbusd_tmp_t ( file ( getattr ioctl lock open read )))
    (allow process session_dbusd_tmp_t ( fifo_file ( getattr open read lock ioctl )))
    (allow process session_dbusd_tmp_t ( sock_file ( getattr open read )))

    ;!!!! this is from audit2allow
    (allow process devpts_t (filesystem (mount)))
    (allow process tmpfs_t (dir (mounton create)))
    (allow process tmpfs_t (file (map)))
    (allow process tmpfs_t (file (mounton create execute open)))
    (allow process tmpfs_t (lnk_file (create)))
    (allow process unconfined_t (unix_stream_socket (connectto)))
    (allow process container_file_t (filesystem (unmount)))
)