I’m testing toolbox, hoping to change it’s SELinux context. What I am trying to achieve is to test several applications with a sandbox context like sandbox_t. The applications should run unconfined in the sandbox, but not see the outside OS or break out.
I created a Thorium Browser toolbox and the SELinux context is unconfined_u:unconfined_r:spc_t:s0 according to :
ps -eZ | grep thorium
unconfined_u:unconfined_r:spc_t:s0 112497 pts/0 00:00:06 thorium
unconfined_u:unconfined_r:spc_t:s0 112511 pts/0 00:00:00 thorium
unconfined_u:unconfined_r:spc_t:s0 112512 pts/0 00:00:00 thorium
unconfined_u:unconfined_r:spc_t:s0 112514 pts/0 00:00:00 thorium
unconfined_u:unconfined_r:spc_t:s0 112543 pts/0 00:00:02 thorium
unconfined_u:unconfined_r:spc_t:s0 112545 pts/0 00:00:00 thorium
unconfined_u:unconfined_r:spc_t:s0 112609 pts/0 00:00:04 thorium
unconfined_u:unconfined_r:spc_t:s0 112721 pts/0 00:00:04 thorium
unconfined_u:unconfined_r:spc_t:s0 112841 pts/0 00:00:00 thorium
unconfined_u:unconfined_r:spc_t:s0 112924 pts/0 00:00:00 thorium
unconfined_u:unconfined_r:spc_t:s0 113084 pts/0 00:00:00 thorium
unconfined_u:unconfined_r:spc_t:s0 113131 pts/0 00:00:00 thorium
unconfined_u:unconfined_r:spc_t:s0 113143 pts/0 00:00:00 thorium
In the past I would do :
sandbox -X -w 1920x1080 -H temphome -T tmp -t sandbox_web_t thorium
Adding toolbox to the workflow, how can I change this context? What are the recommended selinux context for a container running from toolbox
Any container folks change their selinux context for their workflow, or have any recommendations?
Would doing podman run --security-opt label=type:sandbox_t thorium work, or do I need to create an image or directory structure for the application then change it’s context?
I will be adding my findings below.
Well, this has not gotten anywhere with toolbox. It’s a bit limiting in what can be done and has also dropped config files in my /home/<User>/.config/ . I expected this, but just don’t see the viability of using toolbox over something like a proper OCI image like Podman for experimental software. Setting up toolbox is easy and it downloads the minimal fedora image for sure, but without properly containing the program with selinux context or being able to modify them, and further adds to my point.
I’ve done some more digging, podman inspect thorium gives me the config.json file with the arguments and a ton of other info.
podman inspect thorium
[
{
"Id": "e5c18af4f287505b299e89cd307c313218f95b04babd53fba78d308d0c89b350",
"Created": "2024-01-11T19:10:04.620679469-05:00",
"Path": "toolbox",
"Args": [
"--log-level",
"debug",
"init-container",
"--gid",
"1000",
"--home",
"/home/<USER>",
"--shell",
"/bin/bash",
"--uid",
"1000",
"--user",
"<My-User>"
],
This offers a more intriguing prospect for customization of where the application should be confined on my system particularly --home 
this would allow for us to define where in our /home we could set up a directory to confine the application and potentially apply a selinux sandbox context to.
More to come. . .
Editing the toolbox config file resulted in the changes being reverted upon reopening the container. So we’re gonna have to try something different.
i did not intend to create images for all the browsers I want to test, but it looks like to get the customization I need with SELinux, it’s the only way. Let’s create a image using podman defining the config/dockerfile and installing our experimental browser in the minimal fedora image. I will work on defining the changes for --home which might not be necessary if we mount and work from the image, and the selinux context unconfined_u:unconfined_r:spc_t:s0 to a sandbox_file_t changes with podman when we create the image itself.
Moderators : If you need to you can move this to another side of the forum, maybe Water Cooler? or whatever.
)
). My next step would have been to create a report at the SELinux repo. Hopefully, this will foster some discussion and finally adjustments about proper default labelling.
