Add new incus module, add required rules to other modules

policy/modules/apps/qemu.te

@@ -47,6 +47,34 @@ tunable_policy(`qemu_full_network',`
 	corenet_tcp_connect_all_ports(qemu_t)
 ')
 
+#tunable_policy(`qemu_managed_by_incus',`
+optional_policy(`
+	# make this a tunable?
+
+	incusd_stream_connect(qemu_t)
+
+	files_create_generic_tmp_sockets(qemu_t)
+
+	kernel_read_kernel_sysctls(qemu_t)
+
+	# incus VMs wont start otherwise
+	allow qemu_t self:capability { dac_override dac_read_search setuid setgid };
+	allow qemu_t qemu_tmpfs_t:file map;
+
+	# this is due to incus lack of selinux support for VMs
+	kernel_rw_unlabeled_files(qemu_t)
+	kernel_rw_unlabeled_dirs(qemu_t)
+	kernel_manage_unlabeled_symlinks(qemu_t)
+
+	storage_raw_read_fixed_disk(qemu_t)
+	storage_raw_write_fixed_disk(qemu_t)
+
+	container_manage_engine_tmp_files(qemu_t)
+	container_manage_log_files(qemu_t)
+	container_manage_runtime_files(qemu_t)
+	container_manage_runtime_sock_files(qemu_t)
+')
+
 optional_policy(`
 	fs_manage_xenfs_files(qemu_t)
 

policy/modules/kernel/devices.if

@@ -144,6 +144,25 @@ interface(`dev_remount_fs',`
 	allow $1 device_t:filesystem remount;
 ')
 
+########################################
+## <summary>
+##	Allow to watch filesystem and to
+##	watch and watch_sb dir.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to allow
+##	</summary>
+## </param>
+interface(`dev_watch_dev_fs',`
+	gen_require(`
+		type device_t;
+	')
+
+	allow $1 device_t:filesystem watch ;
+	allow $1 device_t:dir { watch watch_sb };
+')
+
 ########################################
 ## <summary>
 ##	Watch the directories in /dev.

policy/modules/kernel/files.if

@@ -452,6 +452,25 @@ interface(`files_dontaudit_getattr_all_tmpfs_files',`
 	dontaudit $1 tmpfsfile:file getattr;
 ')
 
+########################################
+## <summary>
+##	Do not audit attempt to unlin
+##	socket in tmp_t directory
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain to not audit.
+##	</summary>
+## </param>
+#
+interface(`files_dontaudit_unlink_generic_tmp_sockets',`
+        gen_require(`
+                type tmp_t;
+        ')
+
+	dontaudit $1 tmp_t:sock_file unlink;
+')
+
 ########################################
 ## <summary>
 ##	Get the attributes of all directories.
@@ -760,6 +779,24 @@ interface(`files_mmap_read_all_files',`
 	')
 ')
 
+########################################
+## <summary>
+##	Read and memory map usr_t files.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_mmap_read_usr_files',`
+        gen_require(`
+                type usr_t;
+        ')
+
+	mmap_read_files_pattern($1, usr_t, usr_t)
+')
+
 ########################################
 ## <summary>
 ##	Allow shared library text relocations in all files.
@@ -7444,6 +7481,24 @@ interface(`files_create_all_runtime_sockets',`
 	allow $1 pidfile:sock_file create_sock_file_perms;
 ')
 
+########################################
+## <summary>
+##     Create tmp_t sockets.
+## </summary>
+## <param name="domain">
+##	<summary>
+##	Domain allowed access.
+##	</summary>
+## </param>
+#
+interface(`files_create_generic_tmp_sockets',`
+        gen_require(`
+                type tmp_t;
+        ')
+
+	allow $1 tmp_t:sock_file create_sock_file_perms;
+')
+
 ########################################
 ## <summary>
 ##     Delete all runtime sockets.