Merge branch 'features/rocky9_selinux' into 'rocky/main'

Rocky 9 Implementation/Selinux Rewrite

See merge request ADLS/infrastructure/adls.osrancher!15

roles/rke2/selinux/my-iptables.te

-module my-iptables 1.0;
-
-require {
-        type iptables_t;
-        type cgroup_t;
-        class dir ioctl;
-}
-
-#============= iptables_t ==============
-allow iptables_t cgroup_t:dir ioctl;
\ No newline at end of file

roles/rke2/selinux/my-kata.te

-#============= container_t ==============
-allow container_t init_var_run_t:sock_file write;
-allow container_t system_dbusd_var_run_t:sock_file write;
\ No newline at end of file

roles/rke2/selinux/my-node-exporter.cil

+(block my-node-exporter
+    (blockinherit container)
+    (allow my-node-exporter.process init_t (dir (search)))
+    (allow my-node-exporter.process init_t (file (read open)))
+    (allow my-node-exporter.process node_t (tcp_socket (node_bind)))
+    (allow my-node-exporter.process unreserved_port_t (tcp_socket (name_bind)))
+    (allow my-node-exporter.process self (tcp_socket (listen)))
+)

roles/rke2/selinux/my-openstack-ccm.cil

+(block my-openstack-ccm
+    (blockinherit container)
+    (allow my-openstack-ccm.process commplex_main_port_t (tcp_socket (name_connect)))
+    (allow my-openstack-ccm.process node_t (tcp_socket (node_bind)))
+    (allow my-openstack-ccm.process unreserved_port_t (tcp_socket (name_bind)))
+    (allow my-openstack-ccm.process self (tcp_socket (listen)))
+    (allow my-openstack-ccm.process http_port_t (tcp_socket (name_connect)))
+    (allow my-openstack-ccm.process osapi_compute_port_t (tcp_socket (name_connect)))
+    (allow my-openstack-ccm.process neutron_port_t (tcp_socket (name_connect)))
+    (allow my-openstack-ccm.process cert_t (dir (read)))
+    (allow my-openstack-ccm.process cert_t (lnk_file (read)))
+    (allow my-openstack-ccm.process cert_t (file (open read write)))
+)
+

roles/rke2/selinux/my-openstack.te

-module my-openstack 1.0;
-
-require {
-        type cert_t;
-        type container_t;
-        class dir read;
-        class lnk_file read;
-        class file read;
-        class file write;
-        class file open;
-}
-
-#============= container_t ==============
-allow container_t cert_t:dir read;
-allow container_t cert_t:lnk_file read;
-allow container_t cert_t:file {open read write};
\ No newline at end of file

roles/rke2/selinux/my-rke2.te

+module my-rke2 1.0;
+
+require {
+        type container_var_lib_t;
+        type rke2_service_t;
+        class file watch;
+}
+
+
+#============= rke2_service_t ==============
+allow rke2_service_t container_var_lib_t:file watch;

roles/rke2/selinux/udica/base-container.cil

+(block container
+(type process)
+(type socket)
+(roletype system_r process)
+(typeattributeset domain (process ))
+(typeattributeset container_domain (process ))
+(typeattributeset svirt_sandbox_domain (process ))
+(typeattributeset mcs_constrained_type (process ))
+(typeattributeset file_type (socket ))
+(allow process socket (sock_file (create open getattr setattr read write rename link unlink ioctl lock append)))
+(allow process proc_type (file (getattr open read)))
+(allow process cpu_online_t (file (getattr open read)))
+(allow container_runtime_t process (key (create link read search setattr view write)))
+)

roles/rke2/tasks/install_rke2.yml

@@ -5,6 +5,10 @@
     mode: '0755'
   when: not rke2_installed.stat.exists or upgrade
 
+- name: Update crypto-policy to allow SHA1
+  shell: update-crypto-policies --set DEFAULT:SHA1
+  when: not rke2_installed.stat.exists or upgrade
+
 - name: Install RKE2
   command: "/tmp/rke2.sh"
   args:
@@ -16,6 +20,11 @@
   notify:
     - restart rke2
 
+- name: Revert crypto-policy
+  shell: update-crypto-policies --set DEFAULT:NO-SHA1
+  when: not rke2_installed.stat.exists or upgrade
+
+
 # - name: install RHEL RKE2 packages to use latest minor version (otherwise cilium breaks Dont ask why)
 #   dnf:
 #     name:
@@ -27,3 +36,17 @@
   file:
     path: /tmp/rke2.sh
     state: absent
+
+- name: Copy SELinux Policies (rke2)
+  template:
+    src: ../selinux/my-rke2.te
+    dest: /etc/selinux/targeted/policy/my-rke2.te
+  when: ( 'control-plane' in group_names )
+
+- name: Build SELinux exception module (rke2)
+  shell: |
+    checkmodule -M -m -o /etc/selinux/targeted/policy/my-rke2.mod /etc/selinux/targeted/policy/my-rke2.te
+    semodule_package -o /etc/selinux/targeted/policy/my-rke2.pp -m /etc/selinux/targeted/policy/my-rke2.mod
+    semodule -i /etc/selinux/targeted/policy/my-rke2.pp
+  when: ( 'control-plane' in group_names )
+

roles/rke2/tasks/setup_host.yml

@@ -7,6 +7,49 @@
     backup: yes
   loop: "{{ groups['all'] }}"
 
+- name: install RHEL packages
+  dnf:
+    name:
+      - sssd-ldap
+      - container-selinux
+      - cloud-utils-growpart
+      - fapolicyd
+    state: latest
+
+- name: disable firewalld
+  ansible.builtin.systemd:
+    name: "firewalld"
+    enabled: no
+    masked: no
+    state: stopped
+
+- name: enable nftables
+  ansible.builtin.systemd:
+    name: "nftables"
+    enabled: yes
+    state: started
+    masked: no
+
+- name: add kernel params
+  template:
+    src: kernel_params.conf.j2
+    dest: /etc/sysctl.d/rke2_kernel_params.conf
+  register: kernel_params
+
+- name: load kernel params
+  shell: sysctl --system
+  when: kernel_params.changed
+
+- name: add group - etcd 
+  group:
+    name: etcd
+    state: present
+
+- name: add user - etcd
+  user:
+    name: etcd
+    group: etcd
+
 - name: remove rocky user at uid 1000
   user:
     name: rocky
@@ -14,34 +57,50 @@
     remove: yes
   ignore_errors: True 
 
+- name: Download root CA
+  get_url:
+    url: https://curl.se/ca/cacert.pem
+    dest: /etc/ssl/certs
+
+- name: Update CA trust
+  shell: update-ca-trust
+
+
 - name: Resize the disks if volume was expanded (experimental)
   shell: |
     /usr/bin/growpart /dev/vda 2 
     /usr/sbin/pvresize -y -q /dev/vda2 
     /usr/sbin/lvresize -y -q -r -l +100%FREE /dev/mapper/*root 
 
-- name: Disable SELinux
-  selinux:
-    policy: targeted
-    state: permissive
+- name: Copy udica Base Container SELinux Policies 
+  template:
+    src: ../selinux/udica/base-container.cil
+    dest: /etc/selinux/targeted/policy/base-container.cil
+
+- name: Copy SELinux Policies (prometheus/node_exporter)
+  template:
+    src: ../selinux/my-node-exporter.cil
+    dest: /etc/selinux/targeted/policy/my-node-exporter.cil
 
 - name: Copy SELinux Policies
   template:
-    src: ../selinux/my-openstack.te
-    dest: /etc/selinux/targeted/policy/my-openstack.te
+    src: ../selinux/my-openstack-ccm.cil
+    dest: /etc/selinux/targeted/policy/my-openstack-ccm.cil
   when: ( 'control-plane' in group_names )
 
-- name: Build SELinux exception module & allow openstack CCM to mount the /etc/ssl/certs files
+- name: Build SELinux exception modules
   shell: |
-    checkmodule -M -m -o /etc/selinux/targeted/policy/my-openstack.mod /etc/selinux/targeted/policy/my-openstack.te
-    semodule_package -o /etc/selinux/targeted/policy/my-openstack.pp -m /etc/selinux/targeted/policy/my-openstack.mod
-    semodule -i /etc/selinux/targeted/policy/my-openstack.pp
-  when: ( 'control-plane' in group_names )
+    semodule -i /etc/selinux/targeted/policy/my-node-exporter.cil /etc/selinux/targeted/policy/base-container.cil
 
-- name: Enable container_use_cephfs
+- name: Build SELinux exception modules
   shell: |
-    setsebool -P container_use_cephfs 1
-  when: ( 'agents' in group_names )
+    semodule -i /etc/selinux/targeted/policy/my-openstack-ccm.cil /etc/selinux/targeted/policy/base-container.cil
+  when: ( 'control-plane' in group_names )
+
+- name: Disable SELinux
+  selinux:
+    policy: targeted
+    state: permissive
 
 - name: Ensure /var/lib/rancher/rke2/server/manifests
   file:

roles/rke2/templates/manifests/deploy-openstack-ccm.j2

@@ -20,6 +20,10 @@ spec:
   bootstrap: True
   targetNamespace: kube-system
   valuesContent: |-
+    podSecurityContext:
+      seLinuxOptions:
+         type: my-openstack-ccm.process
+
     secret:
       create: false
       name: cloud-config
@@ -55,4 +59,5 @@ spec:
     {#resources:
     #  requests:
     #    cpu: 200m
-    #}
+    #}
\ No newline at end of file
+

roles/rke2/templates/manifests/deploy-rancher-monitoring.j2

@@ -30,3 +30,9 @@ spec:
   chart: rancher-monitoring
   version: {{ item.value.version | default("100.1.0+up19.0.3") }}
   targetNamespace: cattle-monitoring-system
+  valuesContent: |-
+    prometheus-node-exporter:
+       securityContext:
+         seLinuxOptions:
+           type:  my-node-exporter.process
+