From d55a96e8cbbc8d013b6258da304d5c63590e2679 Mon Sep 17 00:00:00 2001
From: Dmitry Sharshakov <dmitry.sharshakov@siderolabs.com>
Date: Sat, 16 Nov 2024 14:04:42 +0100
Subject: [PATCH] refactor: remove SELinux client_u and client_r

I added those in the early days of the current policy development, yet there was no use for them. This change simplifies the policy and handling of labels.

Signed-off-by: Dmitry Sharshakov <dmitry.sharshakov@siderolabs.com>
---
 internal/pkg/selinux/policy/policy.33         | Bin 25413 -> 25197 bytes
 .../policy/selinux/common/typeattributes.cil  |  21 ++++--------------
 .../policy/selinux/immutable/roles.cil        |  12 ----------
 .../selinux/policy/selinux/services/cri.cil   |   2 +-
 .../policy/selinux/services/dashboard.cil     |   2 +-
 .../policy/selinux/services/machined.cil      |   2 +-
 .../selinux/services/system-containerd.cil    |   2 +-
 .../selinux/policy/selinux/services/udev.cil  |   2 +-
 pkg/machinery/constants/constants.go          |   6 ++---
 9 files changed, 12 insertions(+), 37 deletions(-)

diff --git a/internal/pkg/selinux/policy/policy.33 b/internal/pkg/selinux/policy/policy.33
index dc206fbbdc6ffdd935d7e944feacfb66ced4c376..8abf7cf236969c685e18bf3ab0cf36de34d80cdd 100644
GIT binary patch
delta 4084
zcmZ8kU2L0Y6+W-)X7(IsN%Lc;X=A5NvZiSgJ8|Ot+ew`?PGYY~n~tn3cCv+^l_h0M
z(IhrGZ~+LUs@=IjLLdYeNPsqmrd@&7PJ$tR1y^X3224oY4KXedLZEP-&+qyCt+s5R
z@4V;dIp;j@`+ffT+vbCxnb#`k`L$FF|MmP%^ZjF4BKq2NlYA3h!-qfCKWo<c>;1jv
zD!<v^VJ`8z{d;DO^B3}_$b4bIjPY9{k8o(9)2#COfgUr&mj_On1V1~FG6nwbK;l$h
zVi^RL*Yi7{-Yf0Cu=`Z$0Ew3Q?*r2&#r=a@<|2P}aJ_9pv}$~F|LM{}t0)%vpMy`B
z$G9*Q<(Gy!%@Tie=&Bj#4~K4<Vg6(yZ6^8Ki5)Y|zGSai;lAXUnc{MC*JSwZ<d9k5
ze<fpPmfMDV%?!^Bf4M#FNpoZOxxL-blnx@I%kq1}z5Sz})tmdz9h46IqDgwRpLo7>
z5R&UFJUDXF%yWKZ+g#%xj-<>S|7GN4WW!^7>*?Lkl@97eljEk;Q|2<?N=+R{k%r$$
zUE%3KfXkzUQ$ZS~42lnAsUYt&A|GWcjy&$jF<O=Ps7LOq%KX9T43CXPD@7{Oq+MU5
zHF{L!M<mm{ywg^{Ld#SqawAdQq*$M|`W)pbV&zkGijIp6lpFHaI7PaszP=5*qH-N_
z#mQ70z;KA#Kme@ZCuqV=wj!<{7n@^}0M6&EJ!A!nCa4~TbviZ`3Q~%it?v>oxuAo@
z*>qbaNW+wsWfDYKR_v|R>ehsQXde-J#0edf4lGhVd=E*qMM;Di#3Ws_>x(kHJ=Qq|
z1=zC8^q1+T5NxC$Xa~QOPFB!od+p4y*7IxRlSzOtXqC3@n6ORzzd|c+iS>d`^=Q?Y
z#fSLXwjy12Yj{+u7kfYy`pH`p1O#labw=Vz{``2l3n49~9Li|x0Kt*@&*Ob(5;P^A
zh=?+kGC4`)bF{LHiW9?YHI|JF1=I{kCv4&z<&{DHX$rZOVekqLyW)ZqHp_pQXqV{*
z=`rj7h;UoGfoW+6B9cw@fT&$6il<H&rRsDcD;si-wG<buGC=icl8}+VFnPKHdv7C^
zn5a#efts~_Y1uWHa?ZA_#o|XTMJvNo^<b^WM_tO6E*Xy0<wrZXYbwcGQ{6WJMw903
z_LMw6G*Jtml!-kgUN7|jJC4aK-H}uqjRF+_Y&0geiq-S`Q|(+g9j!D_gWF&L)LjZc
z-45^@_Y}HlW#my@Xh6>DvmOG#S4q-FZEh|MQ}~HvCME!<=;3Nnj$9}5OPT*k$e{3|
zx^E$aJ+Mbm-Gk649eqYv131-*&(WOQd7LB8c`RPY1xAH@B*i{+&P5cauqy+dQV<C?
zodhw_rQM(i6cW8mLi$#8^_Ze|e_Uqe?xek$?jbmZtrPY`qsSB>2Nn2?U<hEx%HN+!
zZURiVtQ}>JjzQKjgBH3MaUdv1;jiO@tenHRv}=fSjyq;!mAL4<J4|-~JT)s?(CQ$l
z-nX<h8PA|QsKbqe+lC@T3-tDYI9F{P$PHvhoq^`)lDnPJV=d*ZfLCyUuYkBS6YZO;
z-NBr@U&=;CUvyi5DP4Rc)87YoB{XtBZmm(LVg+X+d@mEZu9QWe)C;nAFYED|@SO0-
zq8*G;%mt5GgUJ+#b2!`1v)O0`*mS!EDM8b+E*6qy!o{B>zn-fO$rKkVxMV9p9BmA$
zso4xy`6UyEjrIgsn#i1Uh=&C)L25<`odSQD?cp<X-QC@i#ybt2(i*Mn^bFsgixz-F
zS&E*jAu3a5BC$>k8%YDBvg@`o*pKqjTr2`>J;tE5o_u<~$9YPq-dEx>`GQpI+^uC2
zt1b%o>rsVUpw4kao{w?b$P<)5M+;hpSk$>27rr`Epxd(OAg_^Wv`5&aCg4}*dyXS{
zihn)dA38xNv^Z|R*b@obL+aj%>cgCE6mMKiR=|BFBhD0U93UtSp;w!=+7|G^M)hea
zOCLsX_{q41Sk?Au8v!4B9H<zWl(;Mx73VAp$^y<J7-g*yZV7r1MNo&&vWilbbCRX{
z;!G}L(!93X!FvmFju-qvK)@%#cOUOypJ?CB)yw~jA8&Se);_!Ly?Q?t3Cr>5_*H#H
z!_O?#^EVcve0!l@{&I-Mg!qpOXZe1?&v%#N{2$RLpy$p-D~0jwTtk4kGV_mW`2M<|
zZ!ZR{@2jqF^MjV*mIpO_@{;D9RVj@BAs@{deNe+cP;363O5qNV)sR!ii-mg52K?N+
z)Xsm)MfpzN&)1ilT=^>=Ih=opf4UTO*W_CM*ZnCMcf7*+Mt5Z*-|Whta`iRcJy+-F
zd->!1k9^3rk1SWSXP0aC`^zWX^>2Cfzgcc^_5ZbgsGx5}^#Oizr5gKir5f-4s{i#L
zt!x^{F<xl1zX85hXn_3si-prob#fCYc}U&giuewRf4>zm=H*hv_~eU^ww{O|qW!|r
ztn*!+1~hjZy|~;J!#kxuiNilBeTg^AEynO(`7A$Mj`Dju^?X-;e_O8SH{`b<*YA|e
z{N#2$FKjnHj38NrGrV7J6Z0^CaXTW*Vg8={_R00HwoBp`=CPeAT+742%iCT2ogD;k
g;9u-Cgxnw$;G5-Ec*k%a$tx?LL;2K9;&Mgwf6s8*b^rhX

delta 4086
zcmYjUU2I!t8U8-UO`PVZahk+-lg(+IWY8o{oH(`<yRq}*I8L3UNk>BqjqSGSD4=v}
z6SN5pM~EM77aR1IxIs)4SAYbYG-(<jMv(xGo3)eR0uUFwLLk8?S3^*R_xb$2$H$g^
z-t(UK_j#Z1JLml4*ZMcV)o)hM^ff4@@blRtAJp|P-rC*UFWsTdtKIbO<tF-Dsg*uD
zbF4M1nzDS|3nTj4ndeR(Dx7z|FaV9(#*cg>bNV9XM~3yMXm6xfuh7dQdwPrhGg8nS
zv^YAZ6ZG6@LC5IlqfhEJ`qSu;p13#Gr=#@5SWK_e*4RYfDu>dD$)CH|ZtazJpWnS+
z+V}J6d3tRut*7bFV>^0@X3uW*%(7ODpS^vfwBOB&JbnM{6@7sopA9C^+_=j~8a&Rr
zh+BVq@8+#%Zr&~Jcd@oWvGJ$%481gdpr`0)JfTyRn7Bs2kNWA|=<&Ae#=5lM!L~*E
z)kIvU>EnrA+Mo2(UNo$i=@tIZ&`+YndXD}O{iaUR)yaUKr-RAi<+v;Fv$yZ;m-Yec
zq)UrBTKN2Fm+s)k?w2eU&8%Le4<{>nn--^HlM61h8<o4CyLP*Bhp}j6^(EIO6TxV6
z^uwv^dXw5>sbe0t@X%W9Vi&N&89o-L14D#Ig<g6m-%78?;(<lAsJa;QqfD5kMRmF+
z(}%Ipc(aPD4Cdj>swg*fjAcwGrP8XIrRPUJRt5e(#qtT}k$?JJ1IM7;^yw;mJ7CRK
zz$VBta;)=r*2=RiMXcPX`keS%YD*1U{k&>%^eN8#q|sMRtrBNLZK#B`M-OqO`%E$f
zO4<uaCbfr4VgxA~52fHF$>AgkA=`#jj=urxpHnNUm1T9Ps1gr-p<8u3g&|MBv8$Q}
zr>qZ}jafNqN@RbY_DTK<n8+ddP?NhU0rpWmL_LWK|0QNnBgbQ&HUf-k$|M2>fwq<F
zlc<1JAi=oc^<w5R$KP-ed5ZIjy^qTproSc<V+(4*sRvjH;D~aZqhRRGOouefnli~x
zE=L{v88zeJ1x$okkS(!PQJr^sK>Qhw17gt2$;r*6<Bm%LJzA|dlXAkMNpVlRc(SI}
zWSrDC6RIM;jHH>1->@l9Flz+>0K>d-I4b#?)ie)Fo1GPL#3sPiiSLZ7CBzXbK<438
zO;DT+ngmA;;Kj5}cFt8erXYzS*RfAIzGzxFlH^$mced1$;Oaq>>oz_^H0vOS#6tR9
zeL?VWPCMP8P+J`3W}___d>aSj!PCL)P!;G33OThZNxdjoP)3Qeppsk|7G92b4%kTX
zKvSAUj+R;uu5jI<C>p^I1cHDC>`S546DjN{0heA_02^8G?W*1B32YiL_Enlsg(5hY
zVIaq{jg?b*XOX{{3Z;5fj}rqmHnAP!&<}rEcEC#(ITl8WZFrf}2b>2z%AjE<_#kK0
z<jhbs9h$)TWpf^8k1YoyU?F+Xn=p%BOAiJbTw5}r_am+9r$_1NJdAC_CSZN&fSm1k
z7s4O~L~Pfi#y`uRDc%ddd@gJjj_|9WlMCUIt!CZN3$RIjmOb(40sRRZ1rXI+uX7VH
zxX0ygPjUf{Zl!n4+-plht6z31cHMBeoN+CjBC}A6=vBS0LYsNZtnmjy+pQeoRUpmK
z`dn}tm7CiYcM0;!K!K4A4TBNV0HXlCIyYi4l77&$cp}}lO$Te40HRA2?3eZa(}sGr
z{WV^jCf__k0ogmlD(sXEeV5V$1|tNmgS{ynHlvTxGZ~EXqG&bB6ea;t2@i$?l@@+#
zxWvWVTa6dDC@B*lh>Q}Xb+nte?IPwUTr!iaem@pg0u#H9&{%e;1w~mW+RP4Bb6kpt
zgYYMt;|En+3}ZLwV6dSsNK=M~VqfIDjBp8Cj$n@>du(CIFO!ArE|_baWn61d8Df;P
z8!Q*(0Se-Ppr5fp(L{ufvSEtP51O4)aK6Nd%3{m$eq$dcxX?zYO+?zUkrwLPc_Z|j
zR*y-`?u$ihmYc8NEM}n|=E8aD@w}f-EeuA`o?Poxoeq5H!ro%2urL%rjWS!v7DD>^
zLUau=1yab;3t|g@5Kr`Yj1U=okXsoRT9!^Mc5hGBo-MgjT$j5Adc{VD9UpSm${3?C
z94IHP9{j)uM8U&u163CT{CNKD^S#Z`;g_ICg#eX{Uiu*4Pxmi+=~S+tPA#?4AM-()
zv&V;@HrM$+hRvG|f5aDlwiu-M`S|uyP`A*7rO3TCuM>C5#GTF6;_TFpUVaib{$9LI
zAke)nFTJ1hnPmU8MkmDxuO}wkmE~HPuhfp-fLH{@;_ud?ogdw~aNSFpr3gR7`{;hr
zM>q2!8ps9dTQM(vH}7}k_gwPYN)!Dr-|SrDbABHJ81PzK>2R*RuyWFoe_-_wUAiNe
z?a|6Hnkck5_S=P8_QOIw#v6rB=lWk<`qtGhN1tA;SAEOsAFlZ5d#knB_g784dqwYC
zAFW>2#;;uLu}2?$r`T>}Ad>ZY-+Hg;_v4+3HxPRDa=>$_sADIfHC?#c<KcHCKB3Ic
zm9Q~kqGe&pKTrmrLn9p0>umR6=Zq(->AySQVE<Q2VS0&Qq<>lp(vM564g9)C|EioO
zT@HE<HT9N1Pv^?5$oHTe@n}UCuJw34uo<9#mjlMPyHcjHN*jH(l7cb)t`ekQRNA$N
c%9R0+^0IM6``9y}JLqAVRsA?=%$m~v53JVc?*IS*

diff --git a/internal/pkg/selinux/policy/selinux/common/typeattributes.cil b/internal/pkg/selinux/policy/selinux/common/typeattributes.cil
index 75de7170db..55a5af3224 100644
--- a/internal/pkg/selinux/policy/selinux/common/typeattributes.cil
+++ b/internal/pkg/selinux/policy/selinux/common/typeattributes.cil
@@ -65,28 +65,15 @@
 
 (typeattribute service_exec_f)
 
-(typeattribute system_service_p)
+(typeattribute service_p)
 ; (process_t, exec_t)
-(macro system_service_p ((type process_label) (type executable_label))
+(macro service_p ((type process_label) (type executable_label))
     (roletype system_r process_label)
-    (typeattributeset system_service_p process_label)
+    (typeattributeset service_p process_label)
     (typeattributeset service_exec_f executable_label)
     (allow process_label executable_label (file (entrypoint execute execute_no_trans)))
 )
 
-(typeattribute client_service_p)
-; (process_t, exec_t)
-(macro client_service_p ((type process_label) (type executable_label))
-    (roletype client_r process_label)
-    (typeattributeset client_service_p process_label)
-    (typeattributeset service_exec_f executable_label)
-    (allow process_label executable_label (file (entrypoint execute execute_no_trans)))
-)
-
-(typeattribute service_p)
-(typeattributeset service_p system_service_p)
-(typeattributeset service_p client_service_p)
-
 (typeattribute system_container_p)
 (macro system_container_p ((type ARG1))
     (roletype system_r ARG1)
@@ -95,7 +82,7 @@
 
 (typeattribute pod_p)
 (macro pod_p ((type ARG1))
-    (roletype client_r ARG1)
+    (roletype system_r ARG1)
     (typeattributeset pod_p ARG1)
 )
 
diff --git a/internal/pkg/selinux/policy/selinux/immutable/roles.cil b/internal/pkg/selinux/policy/selinux/immutable/roles.cil
index 16de279b29..dee25fbab1 100644
--- a/internal/pkg/selinux/policy/selinux/immutable/roles.cil
+++ b/internal/pkg/selinux/policy/selinux/immutable/roles.cil
@@ -11,15 +11,3 @@
 (userlevel system_u systemLow)
 (userrole system_u object_r)
 (userrole system_u system_r)
-
-(role client_r)
-(type client_r)
-(roletype client_r client_r)
-
-(user client_u)
-(userrange client_u (systemLow systemLow))
-(userlevel client_u systemLow)
-(userrole client_u object_r)
-(userrole client_u client_r)
-
-(roleallow system_r client_r)
diff --git a/internal/pkg/selinux/policy/selinux/services/cri.cil b/internal/pkg/selinux/policy/selinux/services/cri.cil
index 4f4e8ecfe8..1c1029904f 100644
--- a/internal/pkg/selinux/policy/selinux/services/cri.cil
+++ b/internal/pkg/selinux/policy/selinux/services/cri.cil
@@ -1,6 +1,6 @@
 ; Pod (CRI) containerd
 (type pod_containerd_t)
-(call client_service_p (pod_containerd_t containerd_exec_t))
+(call service_p (pod_containerd_t containerd_exec_t))
 
 ; TODO: label /run
 
diff --git a/internal/pkg/selinux/policy/selinux/services/dashboard.cil b/internal/pkg/selinux/policy/selinux/services/dashboard.cil
index bea3a84e9b..f0f26860c0 100644
--- a/internal/pkg/selinux/policy/selinux/services/dashboard.cil
+++ b/internal/pkg/selinux/policy/selinux/services/dashboard.cil
@@ -1,2 +1,2 @@
 (type dashboard_t)
-(call system_service_p (dashboard_t init_exec_t))
+(call service_p (dashboard_t init_exec_t))
diff --git a/internal/pkg/selinux/policy/selinux/services/machined.cil b/internal/pkg/selinux/policy/selinux/services/machined.cil
index 4d7f7d6b5f..0a57ecac2a 100644
--- a/internal/pkg/selinux/policy/selinux/services/machined.cil
+++ b/internal/pkg/selinux/policy/selinux/services/machined.cil
@@ -34,7 +34,7 @@
 ; Should not occur unless misconfigured by machined
 (type unconfined_service_t)
 (roletype system_r unconfined_service_t)
-(typeattributeset system_service_p unconfined_service_t)
+(typeattributeset service_p unconfined_service_t)
 
 (type sbin_exec_t)
 (call system_f (sbin_exec_t))
diff --git a/internal/pkg/selinux/policy/selinux/services/system-containerd.cil b/internal/pkg/selinux/policy/selinux/services/system-containerd.cil
index 3cfdffc4a2..9744bc57b2 100644
--- a/internal/pkg/selinux/policy/selinux/services/system-containerd.cil
+++ b/internal/pkg/selinux/policy/selinux/services/system-containerd.cil
@@ -7,7 +7,7 @@
 
 ; System containerd
 (type sys_containerd_t)
-(call system_service_p (sys_containerd_t containerd_exec_t))
+(call service_p (sys_containerd_t containerd_exec_t))
 
 ; TODO: label /system
 
diff --git a/internal/pkg/selinux/policy/selinux/services/udev.cil b/internal/pkg/selinux/policy/selinux/services/udev.cil
index 6a24b1b215..37d81fba27 100644
--- a/internal/pkg/selinux/policy/selinux/services/udev.cil
+++ b/internal/pkg/selinux/policy/selinux/services/udev.cil
@@ -12,7 +12,7 @@
 (filecon "/usr/lib/udev(/.*)?" any udev_exec_t)
 
 (type udev_t)
-(call system_service_p (udev_t udev_exec_t))
+(call service_p (udev_t udev_exec_t))
 
 ; TODO: label /run
 
diff --git a/pkg/machinery/constants/constants.go b/pkg/machinery/constants/constants.go
index 4f4410deec..60aa6e7f4d 100644
--- a/pkg/machinery/constants/constants.go
+++ b/pkg/machinery/constants/constants.go
@@ -811,7 +811,7 @@ const (
 	CgroupPodRuntimeMillicores = 1000
 
 	// SelinuxLabelPodRuntime is the SELinux label for kubernetes containerd runtime processes.
-	SelinuxLabelPodRuntime = "client_u:client_r:pod_containerd_t:s0"
+	SelinuxLabelPodRuntime = "system_u:system_r:pod_containerd_t:s0"
 
 	// CgroupPodRuntimeReservedMemory is the hard memory protection for the cri runtime processes.
 	CgroupPodRuntimeReservedMemory = 196 * 1024 * 1024
@@ -826,13 +826,13 @@ const (
 	CgroupEtcdMillicores = 2000
 
 	// SELinuxLabelEtcd is the SELinux label for etcd process.
-	SELinuxLabelEtcd = "client_u:client_r:etcd_t:s0"
+	SELinuxLabelEtcd = "system_u:system_r:etcd_t:s0"
 
 	// CgroupKubelet is the cgroup name for kubelet process.
 	CgroupKubelet = CgroupPodRuntimeRoot + "/kubelet"
 
 	// SelinuxLabelKubelet is the SELinux label for kubelet process.
-	SelinuxLabelKubelet = "client_u:client_r:kubelet_t:s0"
+	SelinuxLabelKubelet = "system_u:system_r:kubelet_t:s0"
 
 	// CgroupKubeletReservedMemory is the hard memory protection for the kubelet processes.
 	CgroupKubeletReservedMemory = 96 * 1024 * 1024