Secure Podman containers with SELinux and AppArmor mandatory access controls

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1"; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Cleanup function
cleanup() {
    if [ $? -ne 0 ]; then
        log_error "Installation failed. Check the logs above for details."
    fi
}

trap cleanup ERR

# Usage message
usage() {
    echo "Usage: $0 [--skip-updates]"
    echo "  --skip-updates    Skip system package updates"
    exit 1
}

# Parse arguments
SKIP_UPDATES=false
while [[ $# -gt 0 ]]; do
    case $1 in
        --skip-updates)
            SKIP_UPDATES=true
            shift
            ;;
        -h|--help)
            usage
            ;;
        *)
            log_error "Unknown option: $1"
            usage
            ;;
    esac
done

# Check if running as root or with sudo
if [[ $EUID -ne 0 ]]; then
    log_error "This script must be run as root or with sudo"
    exit 1
fi

# Detect distribution
if [ ! -f /etc/os-release ]; then
    log_error "/etc/os-release not found. Cannot detect distribution."
    exit 1
fi

. /etc/os-release
case "$ID" in
    ubuntu|debian)
        PKG_MGR="apt"
        PKG_UPDATE="apt update"
        PKG_UPGRADE="apt upgrade -y"
        PKG_INSTALL="apt install -y"
        MAC_SYSTEM="apparmor"
        ;;
    almalinux|rocky|centos|rhel|ol|fedora)
        PKG_MGR="dnf"
        PKG_UPDATE="dnf check-update || true"
        PKG_UPGRADE="dnf update -y"
        PKG_INSTALL="dnf install -y"
        MAC_SYSTEM="selinux"
        ;;
    amzn)
        PKG_MGR="yum"
        PKG_UPDATE="yum check-update || true"
        PKG_UPGRADE="yum update -y"
        PKG_INSTALL="yum install -y"
        MAC_SYSTEM="selinux"
        ;;
    *)
        log_error "Unsupported distribution: $ID"
        exit 1
        ;;
esac

log_info "Detected distribution: $ID using $MAC_SYSTEM"

# Update system packages
if [ "$SKIP_UPDATES" = false ]; then
    echo "[1/8] Updating system packages..."
    $PKG_UPDATE
    $PKG_UPGRADE
else
    echo "[1/8] Skipping system updates..."
fi

# Install mandatory access control systems
echo "[2/8] Installing mandatory access control system ($MAC_SYSTEM)..."
if [ "$MAC_SYSTEM" = "apparmor" ]; then
    $PKG_INSTALL apparmor apparmor-utils apparmor-profiles apparmor-profiles-extra
    systemctl enable apparmor
    systemctl start apparmor
else
    $PKG_INSTALL selinux-policy-targeted policycoreutils-python-utils setroubleshoot-server
fi

# Verify MAC status
echo "[3/8] Verifying mandatory access control status..."
if [ "$MAC_SYSTEM" = "apparmor" ]; then
    if ! systemctl is-active --quiet apparmor; then
        log_warn "AppArmor is not active. Starting it now..."
        systemctl start apparmor
    fi
    aa-status | head -5
else
    if [ "$(getenforce)" = "Disabled" ]; then
        log_warn "SELinux is disabled. Enabling enforcing mode..."
        setenforce 1
        sed -i 's/SELINUX=disabled/SELINUX=enforcing/' /etc/selinux/config
    fi
    sestatus
fi

# Configure MAC for Podman containers
echo "[4/8] Configuring MAC system for Podman containers..."
if [ "$MAC_SYSTEM" = "selinux" ]; then
    # Configure SELinux booleans for containers
    setsebool -P container_manage_cgroup true
    setsebool -P virt_use_nfs true
    setsebool -P virt_sandbox_use_all_caps true
    log_info "SELinux container booleans configured"
fi

# Create custom security policies
echo "[5/8] Creating custom security policies..."
if [ "$MAC_SYSTEM" = "selinux" ]; then
    # Create SELinux policy directory
    mkdir -p /etc/selinux/local
    
    # Create custom SELinux policy
    cat > /etc/selinux/local/container_custom.te << 'EOF'
policy_module(container_custom, 1.0)

require {
    type container_t;
    type user_home_t;
    type http_port_t;
    class tcp_socket name_bind;
    class dir { read getattr open search };
}

# Allow containers to bind to HTTP ports
allow container_t http_port_t:tcp_socket name_bind;

# Restrict access to user home directories
neverallow container_t user_home_t:dir { read getattr open search };
EOF

    # Compile and install SELinux policy
    checkmodule -M -m -o /etc/selinux/local/container_custom.mod /etc/selinux/local/container_custom.te
    semodule_package -o /etc/selinux/local/container_custom.pp -m /etc/selinux/local/container_custom.mod
    semodule -i /etc/selinux/local/container_custom.pp
    log_info "Custom SELinux policy installed"
    
else
    # Create custom AppArmor profile
    cat > /etc/apparmor.d/podman-custom << 'EOF'
#include <tunables/global>

profile podman-custom flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>
  
  # Network access
  network inet tcp,
  network inet udp,
  network inet6 tcp,
  network inet6 udp,
  network netlink raw,
  
  # File system access (restricted)
  /usr/bin/** rix,
  /bin/** rix,
  /sbin/** rix,
  /lib/** rm,
  /lib64/** rm,
  
  # Container-specific paths
  /var/lib/containers/** rw,
  /tmp/** rw,
  /dev/null rw,
  /dev/zero rw,
  /dev/random r,
  /dev/urandom r,
  
  # Deny access to sensitive system areas
  deny /etc/shadow r,
  deny /etc/passwd w,
  deny /boot/** rwklx,
  deny /sys/kernel/security/** rwklx,
  
  # Capabilities (minimal set)
  capability net_bind_service,
  capability setuid,
  capability setgid,
  capability dac_override,
}
EOF

    # Load AppArmor profile
    apparmor_parser -r /etc/apparmor.d/podman-custom
    systemctl reload apparmor
    log_info "Custom AppArmor profile loaded"
fi

# Configure Podman security settings
echo "[6/8] Configuring Podman security settings..."
mkdir -p /etc/containers
cat > /etc/containers/containers.conf << EOF
[containers]
default_capabilities = [
  "CHOWN",
  "DAC_OVERRIDE",
  "FOWNER",
  "FSETID",
  "KILL",
  "NET_BIND_SERVICE",
  "SETFCAP",
  "SETGID",
  "SETPCAP",
  "SETUID",
  "SYS_CHROOT"
]

seccomp_profile = "/usr/share/containers/seccomp.json"
apparmor_profile = "podman-custom"
selinux = true

[network]
default_network = "podman"
EOF

chown root:root /etc/containers/containers.conf
chmod 644 /etc/containers/containers.conf

# Create Podman security wrapper script
echo "[7/8] Creating Podman security wrapper..."
cat > /usr/local/bin/podman-secure << 'EOF'
#!/bin/bash
# Secure Podman wrapper with mandatory access controls

if [ "$MAC_SYSTEM" = "selinux" ]; then
    exec podman --security-opt label=type:container_t "$@"
else
    exec podman --security-opt apparmor:podman-custom "$@"
fi
EOF

chmod 755 /usr/local/bin/podman-secure
chown root:root /usr/local/bin/podman-secure

# Verification
echo "[8/8] Verifying installation..."

# Check MAC system status
if [ "$MAC_SYSTEM" = "apparmor" ]; then
    if systemctl is-active --quiet apparmor && aa-status | grep -q "podman-custom"; then
        log_info "✓ AppArmor is active with custom Podman profile"
    else
        log_error "✗ AppArmor verification failed"
        exit 1
    fi
else
    if [ "$(getenforce)" = "Enforcing" ] && semodule -l | grep -q "container_custom"; then
        log_info "✓ SELinux is enforcing with custom container policy"
    else
        log_error "✗ SELinux verification failed"
        exit 1
    fi
fi

# Check Podman configuration
if [ -f /etc/containers/containers.conf ]; then
    log_info "✓ Podman security configuration created"
else
    log_error "✗ Podman configuration not found"
    exit 1
fi

# Check security wrapper
if [ -x /usr/local/bin/podman-secure ]; then
    log_info "✓ Secure Podman wrapper created"
else
    log_error "✗ Secure Podman wrapper not found"
    exit 1
fi

echo
log_info "Podman MAC security configuration completed successfully!"
log_info "Use 'podman-secure' command for containers with enhanced security policies"
log_info "Regular 'podman' command will also use the new security defaults"

if [ "$MAC_SYSTEM" = "selinux" ]; then
    log_warn "Note: If SELinux was previously disabled, a system reboot is recommended"
fi