SELinux is preventing falco-driver-loader from loading falco kernel drivers on CentOS 8

[dwindsor]

Currently, SELinux prevents falco-driver-loader from calling insmod on falco .ko files. This is because the .ko files are mislabeled - they need to be relabeled modules_object_t:

type=AVC msg=audit(1634143507.210:1101): avc:  denied  { module_load } for  pid=15732 comm="insmod" path="/root/.falco/falco_centos_4.18.0-305.3.1.el8.x86_64_1.ko" dev="dm-0" ino=3427522 scontext=unconfined_u:unconfined_r:kmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:admin_home_t:s0 tclass=system permissive=0

How to reproduce it

Run falco-driver-loader on a CentOS 8 system with SELinux enabled and the targeted policy loaded.

Expected behaviour

falco-driver-loader should be able to successfully insmod falco kernel modules.

Screenshots

Environment

• Falco version:

• System info:

• Cloud provider or hardware configuration:

• OS:
  NAME="CentOS Linux"
  VERSION="8"
  ID="centos"
  ID_LIKE="rhel fedora"
  VERSION_ID="8"
  PLATFORM_ID="platform:el8"
  PRETTY_NAME="CentOS Linux 8"
  ANSI_COLOR="0;31"
  CPE_NAME="cpe:/o:centos:centos:8"
  HOME_URL="https://centos.org/"
  BUG_REPORT_URL="https://bugs.centos.org/"
  CENTOS_MANTISBT_PROJECT="CentOS-8"
  CENTOS_MANTISBT_PROJECT_VERSION="8"

• Kernel:
  4.18.0-305.3.1.el8.x86_64

• Installation method:
  From source

Additional context