use SELinux to restrict datastore modifications

[bcressey]

Issue number:
#764

Description of changes:
Adds filesystem labels to the four components that we expect to modify the datastore. Extends the policy with rules to allow the transition to api_t and mutations for private_t objects.

Changes updog to store its cached repo metadata outside the reserved filesystem.

Testing done:
Tested aws-dev in a local VM and aws-k8s-1.15 in an EC2 instance. No SELinux denials observed.

Components had the expected label:

# find /usr/bin -context 'system_u:object_r:api_exec_t:s0'
/usr/bin/apiserver
/usr/bin/storewolf
/usr/bin/migrator
/usr/bin/early-boot-config

apiserver ran with the expected label:

$ cat /proc/$(pgrep apiserver)/attr/current
system_u:system_r:api_t:s0

updog worked and created the files in the expected path:

# updog check-update -a
aws-k8s-1.15 0.3.2
aws-k8s-1.15 0.3.1
aws-k8s-1.15 0.3.0

# ls -latrZ /var/cache/bottlerocket-metadata/
total 24
drwxr-xr-x. 3 root root system_u:object_r:local_t:s0 4096 Apr 22 21:01 ..
drwxr-xr-x. 2 root root system_u:object_r:local_t:s0 4096 Apr 22 21:01 .
-rw-r--r--. 1 root root system_u:object_r:local_t:s0 1279 Apr 22 21:02 timestamp.json
-rw-r--r--. 1 root root system_u:object_r:local_t:s0 1471 Apr 22 21:02 snapshot.json
-rw-r--r--. 1 root root system_u:object_r:local_t:s0 3497 Apr 22 21:02 targets.json
-rw-r--r--. 1 root root system_u:object_r:local_t:s0   32 Apr 22 21:02 latest_known_time.json

Policy blocked access from a different label:

# echo -n 'system_u:system_r:system_t:s0' > /proc/self/attr/current
# touch /var/lib/bottlerocket/stuff
[ 1090.055119] audit: type=1400 audit(1587590229.927:7): avc:  denied  { write } for  pid=13065 comm="touch" path="/var/lib/bottlerocket/stuff" dev=
"nvme0n1p10" ino=19 scontext=system_u:system_r:system_t:s0 tcontext=system_u:object_r:private_t:s0 tclass=file permissive=1

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.

[tjkirch]

Would you be willing to do an upgrade (just to the same version) to make sure the full updog cycle is OK?

[bcressey]

Would you be willing to do an upgrade (just to the same version) to make sure the full updog cycle is OK?

I tested a downgrade from this build to v0.3.2, and confirmed the updog worked on both sides.

[jamieand]

LGTM