From 62ffd61289d346341f3761018c8d9e76c6a0116d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pawe=C5=82=20Gronowski?= Date: Thu, 3 Sep 2026 19:09:30 +0200 Subject: [PATCH] docker-engine/rpm: Apply AF_VSOCK SELinux policy MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Activate the known socket-deny CIL modules from one shared list so install and final uninstall remain symmetric. Keep unsupported modules non-fatal on older SELinux userspace. Use the filename-derived module names during removal, which also fixes the stale AF_ALG removal name. Signed-off-by: Paweł Gronowski --- pkg/docker-engine/rpm/docker-ce.spec | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/pkg/docker-engine/rpm/docker-ce.spec b/pkg/docker-engine/rpm/docker-ce.spec index 48045956..bd1a9e08 100644 --- a/pkg/docker-engine/rpm/docker-ce.spec +++ b/pkg/docker-engine/rpm/docker-ce.spec @@ -1,4 +1,5 @@ %global debug_package %{nil} +%global selinux_modules docker-af-alg-deny docker-af-vsock-deny Name: docker-ce Version: %{_version} @@ -113,13 +114,16 @@ mkdir -p ${RPM_BUILD_ROOT}/etc/docker if ! getent group docker > /dev/null; then groupadd --system docker fi -# Load the AF_ALG deny policy when SELinux is enabled. This may fail on systems -# with SELinux userspace < 3.6, or without container-selinux's container_domain -# attribute, so keep installation non-fatal. +# Load the socket deny policies when SELinux is enabled. This may fail on +# systems with SELinux userspace < 3.6, or without container-selinux's +# container_domain attribute, so keep installation non-fatal. if command -v semodule > /dev/null 2>&1 && selinuxenabled 2>/dev/null; then - if ! semodule -i %{_datadir}/docker-ce/selinux/docker-af-alg-deny.cil 2>/dev/null; then - echo "warning: could not load docker-af-alg-deny.cil SELinux policy; AF_ALG SELinux denial is not active" >&2 - fi + for module in %{selinux_modules}; do + policy=%{_datadir}/docker-ce/selinux/$module.cil + if ! semodule -i "$policy" 2>/dev/null; then + echo "warning: could not load $module.cil SELinux policy" >&2 + fi + done fi %preun @@ -129,7 +133,9 @@ fi %systemd_postun_with_restart docker.service if [ "$1" -eq 0 ]; then if command -v semodule > /dev/null 2>&1; then - semodule -r container-af-alg-deny 2>/dev/null || : + for module in %{selinux_modules}; do + semodule -r "$module" 2>/dev/null || : + done fi fi