7.6. 管理 SELinux 配置集

流程

1. 通过创建以下 SelinuxProfile 对象来创建可与非特权工作负载一起使用的策略：

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha2
   kind: SelinuxProfile
   metadata:
     name: nginx-secure
     namespace: nginx-deploy
   spec:
     allow:
       '@self':
         tcp_socket:
         - listen
       http_cache_port_t:
         tcp_socket:
         - name_bind
       node_t:
         tcp_socket:
         - node_bind
     inherit:
     - kind: System
       name: container

2. 运行以下命令，等待 selinuxd 安装策略：

   $ oc wait --for=condition=ready -n nginx-deploy selinuxprofile nginx-secure

   输出示例

   selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure condition met

   策略被放入由 Security Profiles Operator 拥有的容器中的 emptyDir 中。策略以通用中间语言 (CIL) 格式保存，格式为 /etc/selinux.d/<name>_<namespace>.cil。

3. 运行以下命令来访问 pod：

   $ oc -n openshift-security-profiles rsh -c selinuxd ds/spod

验证

1. 运行以下命令，使用 cat 查看文件内容：

   $ cat /etc/selinux.d/nginx-secure_nginx-deploy.cil

   输出示例

   (block nginx-secure_nginx-deploy
   (blockinherit container)
   (allow process nginx-secure_nginx-deploy.process ( tcp_socket ( listen )))
   (allow process http_cache_port_t ( tcp_socket ( name_bind )))
   (allow process node_t ( tcp_socket ( node_bind )))
   )

2. 运行以下命令验证策略是否已安装：

   $ semodule -l | grep nginx-secure

   输出示例

   nginx-secure_nginx-deploy

流程

1. 运行以下命令，将 scc.podSecurityLabelSync=false 标签应用到 nginx-deploy 命名空间：

   $ oc label ns nginx-deploy security.openshift.io/scc.podSecurityLabelSync=false

2. 运行以下命令，将 privileged 标签应用到 nginx-deploy 命名空间：

   $ oc label ns nginx-deploy --overwrite=true pod-security.kubernetes.io/enforce=privileged

3. 运行以下命令来获取 SELinux 配置集使用字符串：

   $ oc get selinuxprofile.security-profiles-operator.x-k8s.io/nginx-secure -n nginx-deploy -ojsonpath='{.status.usage}'

   输出示例

   nginx-secure_nginx-deploy.process%

4. 在 .spec.containers[].securityContext.seLinuxOptions 属性中应用工作负载清单中的输出字符串：

   apiVersion: v1
   kind: Pod
   metadata:
     name: nginx-secure
     namespace: nginx-deploy
   spec:
     containers:
       - image: nginxinc/nginx-unprivileged:1.21
         name: nginx
         securityContext:
           seLinuxOptions:
             # NOTE: This uses an appropriate SELinux type
             type: nginx-secure_nginx-deploy.process

   重要

   在创建工作负载前，SELinux type 必须存在。

流程

1. 运行以下命令，使用 enable-recording=true 标记命名空间：

   $ oc label ns my-namespace spo.x-k8s.io/enable-recording=true

2. 创建包含 recorder: logs 变量的 ProfileRecording 对象：

   apiVersion: security-profiles-operator.x-k8s.io/v1alpha1
   kind: ProfileRecording
   metadata:
     name: test-recording
   spec:
     kind: SelinuxProfile
     recorder: logs
     podSelector:
       matchLabels:
         app: my-app

3. 创建一个工作负载来记录：

   apiVersion: v1
   kind: Pod
   metadata:
     name: my-pod
     labels:
       app: my-app
   spec:
     containers:
       - name: nginx
         image: quay.io/security-profiles-operator/test-nginx-unprivileged:1.21
         ports:
           - containerPort: 8080
       - name: redis
         image: quay.io/security-profiles-operator/redis:6.2.1

4. 输入以下命令确认 pod 处于 Running 状态：

   $ oc -n openshift-security-profiles get pods

   输出示例

   NAME     READY   STATUS    RESTARTS   AGE
   my-pod   2/2     Running   0          18s

5. 确认增强器表示它接收这些容器的审计日志：

   $ oc -n openshift-security-profiles logs --since=1m --selector name=spod -c log-enricher

   输出示例

   I0517 13:55:36.383187  348295 enricher.go:376] log-enricher "msg"="audit" "container"="redis" "namespace"="my-namespace" "node"="ip-10-0-189-53.us-east-2.compute.internal" "perm"="name_bind" "pod"="my-pod" "profile"="test-recording_redis_6kmrb_1684331729" "scontext"="system_u:system_r:selinuxrecording.process:s0:c4,c27" "tclass"="tcp_socket" "tcontext"="system_u:object_r:redis_port_t:s0" "timestamp"="1684331735.105:273965" "type"="SELinux"

验证

1. 删除 pod：

   $ oc -n openshift-security-profiles delete pod my-pod

2. 确认 Security Profiles Operator 协调两个 SELinux 配置集：

   $ oc get selinuxprofiles -n my-namespace

   输出示例

   NAME                   USAGE                                       STATE
   test-recording-nginx   test-recording-nginx_my-namespace.process   Installed
   test-recording-redis   test-recording-redis_my-namespace.process   Installed