Bug 1440208

Description of problem:

SELinux policy for snapd is incomplete and lacks various rules.

Version-Release number of selected component (if applicable):
snapd 2.23.6-4.fc25

How reproducible:

Steps to Reproduce:
1. dnf install snapd --enablerepo=updates-testing
2. logout/login
3. sudo snap install hello-world
4. hello-world

Actual results:
myriad of selinux denials, this is one of them

Expected results:
no selinux denials

Additional info:


Automatically generated rule:

module my-snap 1.0;

require {
	type etc_t;
	type proc_t;
	type devpts_t;
	type var_log_t;
	type device_t;
	type admin_home_t;
	type home_root_t;
	type sysfs_t;
	type snappy_var_t;
	type tmpfs_t;
	type passwd_file_t;
	type var_run_t;
	type snappy_t;
	type modules_object_t;
	type tmp_t;
	type unlabeled_t;
	type snappy_var_lib_t;
	type root_t;
	type ptmx_t;
	type usr_t;
	class process setpgid;
	class unix_stream_socket connectto;
	class sock_file write;
	class chr_file { getattr mounton };
	class filesystem { getattr mount unmount };
	class file { create execute execute_no_trans getattr lock mounton open read write };
	class capability { setgid setuid };
	class dir { add_name create mounton read write };
	class lnk_file { create getattr read };
}

#============= snappy_t ==============
allow snappy_t admin_home_t:dir { add_name create mounton write };
allow snappy_t admin_home_t:lnk_file create;

#!!!! WARNING: 'device_t' is a base type.
allow snappy_t device_t:dir mounton;

#!!!! WARNING: 'device_t' is a base type.
allow snappy_t device_t:filesystem unmount;
allow snappy_t devpts_t:dir mounton;
allow snappy_t devpts_t:filesystem mount;

#!!!! WARNING: 'etc_t' is a base type.
allow snappy_t etc_t:dir mounton;

#!!!! WARNING: 'home_root_t' is a base type.
allow snappy_t home_root_t:dir mounton;
allow snappy_t modules_object_t:dir mounton;
allow snappy_t passwd_file_t:file { getattr open read };
allow snappy_t proc_t:dir mounton;
allow snappy_t proc_t:filesystem unmount;
allow snappy_t ptmx_t:chr_file { getattr mounton };

#!!!! WARNING: 'root_t' is a base type.
allow snappy_t root_t:dir mounton;
allow snappy_t self:capability { setgid setuid };
allow snappy_t self:process setpgid;

#!!!! The file '/run/snapd-snap.socket' is mislabeled on your system.  
#!!!! Fix with $ restorecon -R -v /run/snapd-snap.socket
#!!!! This avc can be allowed using the boolean 'daemons_enable_cluster_mode'
allow snappy_t self:unix_stream_socket connectto;
allow snappy_t snappy_var_lib_t:dir mounton;
allow snappy_t snappy_var_t:dir mounton;
allow snappy_t sysfs_t:dir mounton;
allow snappy_t sysfs_t:filesystem unmount;

#!!!! WARNING: 'tmp_t' is a base type.
allow snappy_t tmp_t:dir mounton;
allow snappy_t tmpfs_t:dir { add_name create mounton read write };
allow snappy_t tmpfs_t:filesystem { getattr mount unmount };
allow snappy_t unlabeled_t:dir mounton;
allow snappy_t unlabeled_t:file { execute execute_no_trans };
allow snappy_t unlabeled_t:lnk_file { getattr read };

#!!!! WARNING: 'usr_t' is a base type.
allow snappy_t usr_t:dir mounton;
allow snappy_t var_log_t:dir mounton;

#!!!! WARNING 'snappy_t' is not allowed to write or create to var_run_t.  Change the label to snappy_var_run_t.
allow snappy_t var_run_t:dir { add_name create mounton write };
allow snappy_t var_run_t:file { create lock mounton open read write };

#!!!! WARNING 'snappy_t' is not allowed to write or create to var_run_t.  Change the label to snappy_var_run_t.
allow snappy_t var_run_t:sock_file write;