selinux-policy: add confined CSI and log-reader support

[SeanDougherty]

Summary

• add an opt-in, MCS-constrained container_csi_sidecar_t domain for trusted CSI helper containers
• grant the new domain the explicit privileged-driver connectto rule plus the read-only sysfs/cgroup startup probes observed in live testing
• allow container_logreader_t the standard read-only sysctl/sysfs probes required by Fluent Bit startup
• document the new domains, security boundaries, rollout ordering, and multi-container MCS caveat
• bump selinux-policy to release 11

No workload receives spc_t capabilities or unconfined attributes from this change.

Why

With CRI SELinux confinement active, managed Azure Disk/File CSI drivers run in spc_t, while registrar and liveness helpers need to call /csi/csi.sock. Adding a direct rule to all container_t workloads would weaken the boundary around every reachable spc_t stream server.

container_csi_sidecar_t limits the new source rule to explicitly selected, platform-managed CSI helpers. It remains MCS constrained and is neither privileged nor unconfined. Live testing found that the helper runtimes also read generic sysfs and cgroup files during startup, so the domain uses the standard read-only refpolicy interfaces for those probes.

AKS Backup host-log collectors separately need container_logreader_t. AVC-driven testing showed Fluent Bit performs additional read-only startup probes covered by standard refpolicy interfaces.

Security boundary

spc_t is shared by privileged system containers, not only CSI drivers. MCS does not narrow container_csi_sidecar_t -> spc_t because spc_t is not MCS constrained and normally runs at s0. Mount-namespace visibility, pathname permissions, and DAC still apply; use the type only for trusted platform CSI helpers with narrowly mounted socket directories.

The log-reader domain intentionally does not receive kubernetes_container_domain, whose policy includes management of runtime, log, and plugin files beyond a read-only collector requirement.

Rollout dependency

Policy support must reach every applicable node before managed CSI manifests select seLinuxOptions.type: container_csi_sidecar_t. Canary Disk/File registrar and liveness containers first. Do not bypass MCS with a static all-category level.

Validation

• Patch62 was regenerated byte-for-byte with git format-patch -U3; patches 1 through 63 replay with zero fuzz.
• A clean release-11 RPM/SRPM build passed, and the regenerated SRPM contains current Patch62/Patch63 byte-for-byte.
• Reproduced the retained ACL node image policy from its exact source commit (eeaf3b79) plus ACL production hotfix/minimization; the result matched the node policy SHA-256 98da0717... exactly.
• The production-shaped candidate preserved all 1,443 baseline types and 89 booleans, removed no baseline TE rules, and added only container_logreader_t and container_csi_sidecar_t.
• Live enforcing canary on managed Azure Disk/File CSI:
  • all four registrar/liveness helpers ran in container_csi_sidecar_t with runtime-assigned MCS categories; privileged drivers remained spc_t
  • actual driver directories and csi.sock inodes were container_file_t:s0, so common container policy supplied directory search and socket-file write; no pathname-socket rule was needed
  • the first typed Disk startup exposed only sysfs_t:file read and cgroup_t:file read; Patch62 now uses dev_read_sysfs() and fs_read_cgroup_files()
  • the corrected Disk/File rerun had zero container_csi_sidecar_t AVCs and zero container restarts
  • an untyped File control reproduced repeated container_t -> spc_t:unix_stream_socket connectto AVCs, registrar crash-loop, and loss of File CSINode registration; selecting the dedicated type restored it
  • both Disk and File drivers remained registered; both storage classes provisioned and mounted volumes and completed exact write/read checks (the File data client used spc_t because this older image separately denies ordinary container_t writes to cifs_t)
• Existing AKS Backup validation remains 12/12, including MSI-only snapshot/delete/restore with shared-key authorization disabled and zero log-reader AVCs.

[Copilot]

Pull request overview

This PR updates the Azure Linux selinux-policy SRPM to support confined AKS Backup and managed CSI sidecars when CRI SELinux confinement is enabled, primarily by extending container_t ↔ spc_t socket connectivity and adding narrowly-scoped read permissions for container_logreader_t.

Changes:

• Bump selinux-policy spec release from 10 to 11 and add a corresponding changelog entry.
• Add a policy rule allowing container_t to connectto spc_t Unix stream sockets (for CSI sidecars → privileged driver).
• Add targeted read-only sysctl/sysfs permissions for container_logreader_t (Fluent Bit startup probes).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
acl/SPECS/selinux-policy/selinux-policy.spec	Bumps SRPM release to 11 and wires in the two new policy patches plus changelog.
acl/SPECS/selinux-policy/0062-container-Allow-default-containers-to-connect-to-SPC.patch	Grants container_t the connectto permission to spc_t Unix stream sockets to prevent CSI sidecar crash-loops under confinement.
acl/SPECS/selinux-policy/0063-container-Allow-log-reader-runtime-probes.patch	Grants container_logreader_t additional read-only access needed for Fluent Bit runtime probes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

🔵 Needs a closer look

SELinux policy changes (notably cross-domain socket connectto to spc_t) are security-sensitive and warrant final human review of the confinement boundary impact.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

SELinux policy changes (notably cross-domain connectto into spc_t) are security-sensitive and should receive final human review despite no issues found in the diff.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

SELinux policy changes (especially new domain creation and cross-domain connectto allowances) are security-sensitive and warrant final human review before approval.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

SELinux policy changes (new domain + privileged-domain connect rules) are security-sensitive and warrant final human review despite the changes appearing internally consistent.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0 new
• Review effort level: Lite

Dismissing as feedback was incorporated