remove permissive types from SELinux policy

[bcressey]

Issue number:
#764

Description of changes:
This removes all permissive types from the policy, meaning that actions will be denied and not simply logged, as they are today.

Testing done:

Ran sonobuoy on a k8s 1.16 cluster.

$ sonobuoy run --kube-conformance-image-version v1.16.8 --mode certified-conformance
$ sonobuoy results $(sonobuoy retrieve)
Plugin: e2e
Status: passed
Total: 4731
Passed: 276
Failed: 0
Skipped: 4455

Confirmed that the policy is enforced.

# echo -n 'system_u:system_r:container_t:s0' > /proc/self/attr/current
bash: echo: write error: Permission denied

[  289.111027] audit: type=1400 audit(1591976578.536:3): avc:  denied  { dyntransition } for  pid=8105 comm="bash" scontext=system_u:system_r:super_t:s0 tcontext=system_u:system_r:container_t:s0 tclass=process permissive=0

# cat /proc/self/attr/current
system_u:system_r:super_t:s0

Verified that the operator can upgrade the system when the policy is enforced.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[tjkirch]

I'm a little worried about losing some debugging ability in the admin container, but if you OK your other testing and you could check that normal debugging is still OK, I'm fine.

[bcressey]

I've updated my testing results to indicate that the operator can upgrade nodes when the policy is enforced.