expand file and process restrictions in the SELinux policy

[bcressey]

Issue number:
N/A

Description of changes:
Since host container user data can be used to pass secrets, we should block reads as well as writes to this content. Similarly, because the user data is saved in the datastore, we should also restrict access to those files.

This prevents most processes from sending signals to processes in a different domain, which could trigger unexpected system behavior.

Testing done:
Ran an unprivileged container:

docker run -it --rm --pid=host --security-opt label=type:container_t \
  -v /var/lib/bottlerocket:/datastore -v /local/host-containers:/host-containers \
  amazonlinux:2 bash

Verified that I could not kill a system daemon:

bash-4.2# pkill chronyd
pkill: killing pid 3202 failed: Permission denied
pkill: killing pid 3263 failed: Permission denied

Verified that I could not read host container files:

bash-4.2# ls -latrZ /host-root/local/host-containers/
ls: cannot open directory /host-root/local/host-containers/: Permission denied

Verified that I could not read datastore files:

bash-4.2# ls -latrZ /host-root/var/lib/bottlerocket/
ls: cannot open directory /host-root/var/lib/bottlerocket/: Permission denied

Launched aws-k8s-1.19 aarch64 nodes; sonobuoy run passed.

Launched aws-k8s-1.19 x86_64 nodes; verified that CloudWatch Agent and Fluent Bit could collect logs and post to CloudWatch.

Launched aws-ecs-1 aarch64 node; verified that an ECS task could run and complete.

No AVC denials were logged in these scenarios.

Terms of contribution:

By submitting this pull request, I agree that this contribution is dual-licensed under the terms of both the Apache License, version 2.0, and the MIT license.