add initial selinux implementation

[bcressey]

Issue #, if available:
N/A

Description of changes:
This implements a policy for SELinux aimed at closing vectors for persistence of malicious code across container restarts and reboots.

The initial goals are that containerized processes:

• cannot modify API settings in /var/lib/thar
• cannot modify layer archives for containers

Testing done:
Processes on a running system are labeled as indicated in subject.cil, and files and directories have the labels indicated in object.cil.

Launched a new node and ran sonobuoy conformance tests. No AVC denials were logged.

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[bcressey]

Changes since initial draft:

Dropped SELinux enablement for Docker. This was done for consistency with containerd, which does not yet support assigning random MCS labels to pods.

Widened access to /local, leaving it open to containers except for certain blacklisted paths. The whitelist approach was hard to match up with the ecosystem of plugins for kubelet. It may return in a different form later.

Refocused policy to deny writes to critical files: containerd's pristine layer archives and the settings for our API.

Expanded the policy to cover all file-like classes and permissions.

[bcressey]

Hit a couple of denials when testing the EFS CSI driver:

[ 1984.521571] audit: type=1400 audit(1582000601.532:3): avc: denied { mount } for pid=23455 comm="mount.nfs4" name="/" dev="0:323" ino=3728010751851903760 scontext=system_u:system_r:container_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=filesystem permissive=1
...
[ 2174.430136] audit: type=1400 audit(1582000791.440:4): avc: denied { mounton } for pid=27667 comm="mount.nfs4" path="/var/lib/kubelet/pods/106d0a5c-5207-11ea-bac1-0646452c901a/volumes/kubernetes.io~csi/efs-pv/mount" dev="0:323" ino=3728010751851903760 scontext=system_u:system_r:container_t:s0-s0:c0.c1023 tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=1

[iliana]

I think this is fine to merge. I'd like to see issues opened to track what we're going to remove permissive bits around and at what point we feel confident removing those.

[abby-fuller]

I'm good with this, assuming we add the docs/comments we just talked about/you have notes on :)

[bcressey]

Notes:

• Create issue with next steps for SELinux implementation
• Document what's in scope for the current implementation - SELinux section in SECURITY.md equivalent
• Document assumptions such as shared responsibility model
• Provide pod security policy excerpts e.g. block running as super_t

[bcressey]

Added issues for related items: #764, #765, #766.