From ae423e428bd8fa460dbb10fbcba2966e50ef56d4 Mon Sep 17 00:00:00 2001 From: Tycho Andersen Date: Tue, 21 Mar 2017 12:08:14 -0600 Subject: [PATCH] selinux: add readme Signed-off-by: Tycho Andersen --- projects/selinux/README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100644 projects/selinux/README.md diff --git a/projects/selinux/README.md b/projects/selinux/README.md new file mode 100644 index 000000000..0471f5d8f --- /dev/null +++ b/projects/selinux/README.md @@ -0,0 +1,14 @@ +# selinux + +The ultimate goal here is to use SELinux as our default LSM in Moby. To this +end, here are the compiler flags and userspace packages necessary to do the +basics. + +# TODO + +All the necessary binaries exist, so the next steps are: + +* label the filesystem with a default label +* have a policy that contains containerd +* label each container's files seprately, and contain them each with a policy +* policies for other system daemons