9006-mount-setup-mount-etc-with-specific-label.patch

From d45be2a1f7a2d58efff7921c350fffe8f26901a4 Mon Sep 17 00:00:00 2001
From: Ben Cressey <bcressey@amazon.com>
Date: Thu, 9 Jul 2020 20:00:36 +0000
Subject: [PATCH] mount-setup: mount /etc with specific label

The filesystem is mounted after we load the SELinux policy, so we can
apply the label we need to restrict access.

Signed-off-by: Ben Cressey <bcressey@amazon.com>
---
 src/shared/mount-setup.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c
index 03fc774..8a25823 100644
--- a/src/shared/mount-setup.c
+++ b/src/shared/mount-setup.c
@@ -61,6 +61,8 @@ typedef struct MountPoint {
 #define N_EARLY_MOUNT 4
 #endif
 
+#define ETC_CONTEXT ",context=system_u:object_r:etc_t:s0"
+
 static const MountPoint mount_table[] = {
         { "proc",        "/proc",                     "proc",       NULL,                                      MS_NOSUID|MS_NOEXEC|MS_NODEV,
           NULL,          MNT_FATAL|MNT_IN_CONTAINER|MNT_FOLLOW_SYMLINK },
@@ -112,6 +114,8 @@ static const MountPoint mount_table[] = {
 #endif
         { "bpf",         "/sys/fs/bpf",               "bpf",        "mode=700",                                MS_NOSUID|MS_NOEXEC|MS_NODEV,
           NULL,          MNT_NONE,                  },
+        { "tmpfs",       "/etc",                      "tmpfs",      "mode=755" ETC_CONTEXT,                    MS_NOSUID|MS_NOEXEC|MS_NODEV|MS_NOATIME,
+          NULL,          MNT_FATAL|MNT_IN_CONTAINER },
 };
 
 bool mount_point_is_api(const char *path) {
-- 
2.40.1