Confine the ktls service

The ktls-utils package provides a TLS handshake user agent that listens
for kernel requests and then materializes a user space socket endpoint
on which to perform these handshakes. The resulting negotiated session
parameters are passed back to the kernel via standard kTLS socket
options.

dist/targeted/modules.conf

@@ -3036,3 +3036,11 @@ powerprofiles = module
 #
 #
 pcm = module
+
+# Layer: contrib
+# Module: ktls
+#
+# Policy for ktls - TLS handshake agent for kernel sockets
+#
+#
+ktls = module

policy/modules/contrib/ktls.fc

@@ -0,0 +1 @@
+/usr/sbin/tlshd		--	gen_context(system_u:object_r:ktlshd_exec_t,s0)

policy/modules/contrib/ktls.if

@@ -0,0 +1 @@
+## <summary>ktls - TLS handshake agent for kernel sockets</summary>

policy/modules/contrib/ktls.te

@@ -0,0 +1,13 @@
+policy_module(ktls, 1.0)
+
+########################################
+#
+# Declarations
+#
+
+type ktlshd_t;
+type ktlshd_exec_t;
+init_daemon_domain(ktlshd_t, ktlshd_exec_t)
+
+permissive ktlshd_t;
+