protect snapshot layers via SELinux policy

[bcressey]

Issue number:
#764

Description of changes:
Make host-ctr, docker, and containerd pass a context= option for overlayfs mounts, to allow writes to the upper layer that would be blocked by labels on the lower layers.

Update the SELinux policy such that layers receive a different label when unpacked.

Fix a warning from runc by avoiding an incorrect attempt to mount mqueue with a label that does not match the host.

Testing done:

Tested aws-dev image locally and aws-k8s-1.15 image in EC2. Verified that conformance test passed. No AVC denials were logged. No SELinux warnings were logged for the mqueue mount.

Confirmed via mount that host containers, Kubernetes pods, and Docker containers have the context option specified.

# host-ctr
overlay on /run/host-containerd/io.containerd.runtime.v2.task/default/control/rootfs type overlay (rw,relatime,context=system_u:object_r:local_t:s0,...)

# k8s
overlay on /run/containerd/io.containerd.runtime.v2.task/k8s.io/a96361aa8a9104e5e67b0323af70dced907fdbac365f6d763bb2a40afc2d7a87/rootfs type overlay (rw,relatime,context=system_u:object_r:local_t:s0,...)

# docker
overlay on /local/var/lib/docker/overlay2/3f3a32a4f6a20aee6bc9c783b7332c51716d8e25104d57de4dee92194d91cef8/merged type overlay (rw,relatime,context="system_u:object_r:local_t:s0:c472,c993",...)

Confirmed that underlying directories have the cache_t label:

# ls -latrZ /var/lib/docker/overlay2/
drwx------.  3 root root system_u:object_r:cache_t:s0 4096 May 28 22:11 4a0ae1371ad625c99d1247a32f87f65ed8055ee22d70f93992fd69239c4f938a

# ls -latrZ /var/lib/host-containerd/io.containerd.snapshotter.v1.overlay
drwx------. 13 root root system_u:object_r:cache_t:s0  4096 May 28 22:10 snapshots

# ls -latrZ /var/lib/containerd/io.containerd.snapshotter.v1.overlayfs
drwx------. 54 root root system_u:object_r:cache_t:s0   4096 May 28 21:41 snapshots

Confirmed that files created inside the container end up with the local_t label:

# find /var/lib/host-containerd/ -type f -context 'system_u:object_r:local_t:s0'
/var/lib/host-containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/14/fs/var/log/amazon/ssm/amazon-ssm-agent.log
/var/lib/host-containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/14/fs/var/log/amazon/ssm/errors.log
...

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[bcressey]

Added a rule to cover /var/lib/containerd/io.containerd.metadata.v1.bolt/meta.db, under the assumption that the database also warrants protection.

Verified that an attempted write triggered a denial:

# echo -n 'system_u:system_r:container_t:s0' > /proc/self/attr/exec
# touch /var/lib/containerd/io.containerd.metadata.v1.bolt/meta.db
[ 1230.428146] audit: type=1400 audit(1591052837.699:11): avc:  denied  { write } for  pid=32082 comm="touch" name="meta.db" dev="nvme1n1p1" ino=784924 scontext=system_u:system_r:container_t:s0 tcontext=system_u:object_r:cache_t:s0 tclass=file permissive=1