gremlin.process encounters avc denials on OpenShift 4.2

[philgebhardt]

Background

OpenShift 4.2 appears to use Cri-O 1.14, which predates Cri-O/OpenShift issue openshift/origin#25488, where using the host's IPC/pid/net namespace forces the use of the spc_t process label. As such, this issue is currently undetectable in current versions of Cri-O/OpenShift.

For versions unaffected by the linked OpenShift issue, the gremlin.process process label produced by these SELinux policies is unable to invoke runc to create sidecars due to missing SELinux policies.

Reproduction

1. Follow the described steps for installing Gremlin and these SELinux policies on OpenShift 4.2
2. Try to attack a Kubernetes service

Expected: attacks work
Actual: attacks fail, avc denials can be found in /var/log/audit/audit.log

[philgebhardt]

fixed in v0.0.3