feat: add flatpak policy #1
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
secureblue-bot
force-pushed
the
f42-secureblue
branch
from
a79c23f to
09778e1
Compare
secureblue-bot
force-pushed
the
f42-secureblue
branch
from
09778e1 to
37e7bbf
Compare
HastD
force-pushed
the
flatpak
branch
2 times, most recently
from
3791472 to
92fe350
Compare
secureblue-bot
force-pushed
the
f42-secureblue
branch
from
e46d04b to
6a429ff
Compare
Currently flatpak is not compatible with SELinux confined users: the flatpak executable does not have the necessary permissions to create the sandbox. This policy solves this by confining the flatpak program itself (and the helper programs it calls, such as bwrap) in an application domain with the necessary permissions, which transitions back into the user domain to run the sandboxed flatpak application. For example, if a `staff_u` user runs a flatpak application from the user domain `staff_t`, flatpak will run in `staff_flatpak_t`, while the app will run in `staff_t`. The policy also includes more fine-grained labeling for flatpak app library files, data files, cache files, and temporary files. Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>
Fixes denials that newly show up with this policy in Fedora 43.
Fixes an AVC denial.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Currently flatpak is not compatible with SELinux confined users: the flatpak executable does not have the necessary permissions to create the sandbox. This policy solves this by confining the flatpak program itself (and the helper programs it calls, such as bwrap) in an application domain with the necessary permissions, which transitions back into the user domain to run the sandboxed flatpak application.
For example, if a
staff_uuser runs a flatpak application from the user domainstaff_t, flatpak will run instaff_flatpak_t, while the app will run instaff_t.The policy also includes more fine-grained labeling for flatpak app library files, data files, cache files, and temporary files.
A couple logistical notes:
flatpak-system-helper, and we don't want to accidentally override that policy.