From 8edc417559e0a0ced056be393abe15266284eb84 Mon Sep 17 00:00:00 2001
From: Richard Filo <rfilo@redhat.com>
Date: Mar 23 2021 16:04:32 +0000
Subject: plugins: Add containers plugin


It tries to find an issue related to spc_t and container_t domains where target class is dir or file.

---

diff --git a/plugins/src/containers.py b/plugins/src/containers.py
new file mode 100644
index 0000000..624671c
--- /dev/null
+++ b/plugins/src/containers.py
@@ -0,0 +1,83 @@
+# @author Richard Filo<rfilo@redhat.com>
+#
+# Copyright (C) 2021 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, write to the Free Software
+# Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+#
+
+import gettext
+translation=gettext.translation('setroubleshoot-plugins', fallback=True)
+_=translation.gettext
+
+from setroubleshoot.util import *
+from setroubleshoot.Plugin import Plugin
+
+class plugin(Plugin):
+
+    summary =_('SELinux is preventing $SOURCE_PATH that runs inside a container the "$ACCESS" access to "$TARGET_PATH"')
+
+    def get_problem_description(self, avc, args):
+        if args[0] == 'spc_t':
+            return _('"$SOURCE_PATH", that runs inside a container, is trying to $ACCESS $TARGET_CLASS "$TARGET_PATH". The container runs as a super privileged container (spc_t), which should be avoided if possible.')
+        else:
+            return _('"$SOURCE_PATH", that runs inside a container, is trying to $ACCESS $TARGET_CLASS "$TARGET_PATH".')
+
+    fix_description = _('A better way to fix this issue is using "udica", which creates a custom policy module for your container. The custom policy would allow only this container access to $TARGET_PATH. If you relabel the file, all containers will have access to it.')
+    
+    def get_fix_cmd(self, avc, args):
+        if args[1] == 'file':
+            return '/usr/sbin/semanage fcontext -a -t container_file_t $TARGET_PATH && /usr/sbin/restorecon -v $TARGET_PATH'
+        elif args[1] == 'dir':
+            return '/usr/sbin/semanage fcontext -a -t container_file_t "$TARGET_PATH(/.*)?" && /usr/sbin/restorecon -R -v $TARGET_PATH'
+
+    def get_then_text(self, avc, args):
+        if args[0] == 'spc_t':
+            return _('You can generate a custom policy module for your container by using "udica", or You can relabel "$TARGET_PATH" to container_file_t to allow the access. Please avoid using super privileged containers (spc_t) if possible.')
+        else:
+            return _('You can generate a custom policy module for your container by using "udica", or You can relabel "$TARGET_PATH" to container_file_t to allow the access.')
+
+    if_text = _('If you believe that the container executing "$SOURCE_PATH" should be allowed $ACCESS access on the "$TARGET_BASE_PATH" $TARGET_CLASS')
+    
+    def get_do_text(self, avc, args):
+        do_text = """Use udica to generate a custom policy module.
+Please see https://github.com/containers/udica for more details.
+Or use the following commands to relabel "$TARGET_PATH" to container_file_t:
+"""
+        if args[1] == 'file':
+            command ="""# semanage fcontext -a -t container_file_t $TARGET_PATH
+# restorecon -v $TARGET_PATH"""
+        elif args[1] == 'dir':
+            command ="""# semanage fcontext -a -t container_file_t "$TARGET_PATH(/.*)?"
+# restorecon -R -v $TARGET_PATH"""
+        return _(do_text + command)
+
+    def init_args(self, args):
+        if args[0] == 'spc_t':
+            self.level = 'red'
+            self.summary = _('SELinux is preventing "$SOURCE_PATH", that runs inside a super privileged container, from "$ACCESS" access on $TARGET_CLASS "$TARGET_PATH".')
+            self.fixable = False
+
+    def __init__(self):
+        Plugin.__init__(self, __name__)
+        self.fixable = True
+        self.button_text=_("Relabel\nFile")
+
+    def analyze(self, avc):
+        if avc.has_tclass_in(['file', 'dir']):
+            if avc.matches_source_types(['container_t']): 
+                return self.report(('container_t', avc.tclass))
+            elif avc.matches_source_types(['spc_t']): 
+                return self.report(('spc_t', avc.tclass))
+        return None