selinux-policy: add etc_secret_t label

Add a label etc_secret_t to be used for configuration files stored under
/etc that include secrets. The current label used for secret mounts
under /etc is secret_t but this label permits bootstrap containers
to write to objects. etc_secret_t disallows this behavior.

Signed-off-by: Gavin Inglis <[email protected]>

Author: ginglis13

packages/selinux-policy/object.cil

@@ -138,6 +138,11 @@
 (roletype object_r secret_t)
 (context secret (system_u object_r secret_t s0))
 
+; Files for saved system secrets in config files in /etc.
+(type etc_secret_t)
+(roletype object_r etc_secret_t)
+(context etc_secret (system_u object_r etc_secret_t s0))
+
 ; Dynamic objects are files on temporary storage with special rules.
 (typeattribute dynamic_o)
 (typeattributeset dynamic_o (etc_t binfmt_misc_fs_t))
@@ -162,7 +167,7 @@
 ; modified by system-level processes.
 (typeattribute write_restricted_o)
 (typeattributeset write_restricted_o (
-  cache_t csi_exec_t lease_t measure_t secret_t state_t private_t))
+  cache_t csi_exec_t lease_t measure_t secret_t etc_secret_t state_t private_t))
 
 ; Read-restricted objects are files on local storage that can only be
 ; opened by system-level processes.
@@ -210,6 +215,6 @@
   network_exec_t bus_exec_t runtime_exec_t
   mount_exec_t cni_exec_t csi_exec_t
   any_t etc_t proc_t binfmt_misc_fs_t
-  local_t data_t private_t secret_t cache_t
+  local_t data_t private_t secret_t etc_secret_t cache_t
   lease_t measure_t state_t
   api_socket_t))

packages/selinux-policy/rules.cil

@@ -221,6 +221,12 @@
 (allow api_s secret_t (files (mutate mount)))
 (allow runtime_s secret_t (files (mutate mount)))
 
+; Trusted components can modify secrets stored in /etc config files.
+(allow trusted_s etc_secret_t (files (mutate)))
+
+; Untrusted components cannot modify secrets stored in /etc config files.
+(neverallow untrusted_s etc_secret_t (files (mutate)))
+
 ; Subjects that control the OS can write to and manage mounts for
 ; "sensitive" files and directories on /local.
 (allow control_s sensitive_o (files (mutate mount)))